30149d9556f178c28e1979f8f10f82800199157674098e9a05be93eccdaa59e3

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2023, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Payment advise.exe
Size

432KB
MD5

f53e373bcbb159929b316d01bd4bb674
SHA1

c5b593139f511e8fc57fc28a1bf7838d5314dca0
SHA256

30149d9556f178c28e1979f8f10f82800199157674098e9a05be93eccdaa59e3
SHA512

615a8d4ecc34182470141af8860aa03929558a80eb80a07d9d31a3195b4f665ab41d83f4c0b1005a6339f0c4603f2075207b866841cdb98bd8768d678b4b66c1
SSDEEP

6144:yYa6fM/p5HwVquKO8g4ZPpywgSS1G2PTwChxGcCoTYjwiqf9g7CO3Tdi:yYpM8YdOQRA1G2PtruCYjYf9MXM

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	etrbpet.exe

Executes dropped EXE 2 IoCs

pid	Process
180	etrbpet.exe
2172	etrbpet.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 180 set thread context of 2172	180	etrbpet.exe	87
PID 2172 set thread context of 2636	2172	etrbpet.exe	40
PID 3220 set thread context of 2636	3220	colorcpl.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	1152	WerFault.exe	95

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
180	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
2172	etrbpet.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe
3220	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	etrbpet.exe
Token: SeDebugPrivilege	3220	colorcpl.exe
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2636	Explorer.EXE
2636	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 180	3096	Payment advise.exe	85
PID 3096 wrote to memory of 180	3096	Payment advise.exe	85
PID 3096 wrote to memory of 180	3096	Payment advise.exe	85
PID 180 wrote to memory of 2172	180	etrbpet.exe	87
PID 180 wrote to memory of 2172	180	etrbpet.exe	87
PID 180 wrote to memory of 2172	180	etrbpet.exe	87
PID 180 wrote to memory of 2172	180	etrbpet.exe	87
PID 2636 wrote to memory of 3220	2636	Explorer.EXE	88
PID 2636 wrote to memory of 3220	2636	Explorer.EXE	88
PID 2636 wrote to memory of 3220	2636	Explorer.EXE	88
PID 3220 wrote to memory of 1152	3220	colorcpl.exe	95
PID 3220 wrote to memory of 1152	3220	colorcpl.exe	95
PID 3220 wrote to memory of 1152	3220	colorcpl.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\Payment advise.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment advise.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\etrbpet.exe
    "C:\Users\Admin\AppData\Local\Temp\etrbpet.exe" C:\Users\Admin\AppData\Local\Temp\nkcrwxo.pay
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:180
  - - C:\Users\Admin\AppData\Local\Temp\etrbpet.exe
      "C:\Users\Admin\AppData\Local\Temp\etrbpet.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1152
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1152 -s 136
      4⤵
      Program crash
      PID:4324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 1152 -ip 1152
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\apcett.v

Filesize
205KB

MD5
7ce58eb076bf021a751ab7523622a569

SHA1
5580cd8df71bcf1a0d4d1c2823cc87fd9859ae1f

SHA256
21f13e26e05a4fd173b7d9bed2d026656de098ab11e437e67cd7dca0d2890f5c

SHA512
624e5468efa482f1365c14c74d0d204d13bc35eadcc8305735c455ebcfacbe2c4d64bb610ae79e35241bfcdf7dcd4bd25a4b68185e6f71762664f69995643452

Download Submit
C:\Users\Admin\AppData\Local\Temp\etrbpet.exe

Filesize
137KB

MD5
fa9c760d2f1fa51f0c5fc931f60cdda9

SHA1
95e5d1b6f0e8157157ce62f593bab962a0fd6f5d

SHA256
555e76ed54851418c0bd60ab83c6cb8fe2b76edfed0f1383d9da18acf8c1a655

SHA512
22d661704bd3b50948bdbc203a6cd05c14e3c113097dcb350be26c58191c8fdf2ce3338d216dfdf02c135a1c0a64077de6c85c3ade12c9a32c71f356d0ad4b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\etrbpet.exe

Filesize
137KB

MD5
fa9c760d2f1fa51f0c5fc931f60cdda9

SHA1
95e5d1b6f0e8157157ce62f593bab962a0fd6f5d

SHA256
555e76ed54851418c0bd60ab83c6cb8fe2b76edfed0f1383d9da18acf8c1a655

SHA512
22d661704bd3b50948bdbc203a6cd05c14e3c113097dcb350be26c58191c8fdf2ce3338d216dfdf02c135a1c0a64077de6c85c3ade12c9a32c71f356d0ad4b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\etrbpet.exe

Filesize
137KB

MD5
fa9c760d2f1fa51f0c5fc931f60cdda9

SHA1
95e5d1b6f0e8157157ce62f593bab962a0fd6f5d

SHA256
555e76ed54851418c0bd60ab83c6cb8fe2b76edfed0f1383d9da18acf8c1a655

SHA512
22d661704bd3b50948bdbc203a6cd05c14e3c113097dcb350be26c58191c8fdf2ce3338d216dfdf02c135a1c0a64077de6c85c3ade12c9a32c71f356d0ad4b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\nkcrwxo.pay

Filesize
5KB

MD5
d5d066735ac5be0b041b435f67307a76

SHA1
57a05102d17ac754192e6a178b50ad6e2e7221a1

SHA256
d73621a04bba9fb070571aad3bea90b2e4f6f2d231fec263954eedca9c66327b

SHA512
7b84179b5be6a880ca4c831bc757e60178dc18a592c3075b7139f4482081113ec1b6d4e26ab115987d3e3375f8f64a7b4ca27073b6a8da341452f4411c8d480e

Download Submit
memory/2172-147-0x00000000018A0000-0x0000000001BEA000-memory.dmp

Filesize
3.3MB

Download
memory/2172-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-148-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/2172-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-155-0x0000000008FF0000-0x00000000090E7000-memory.dmp

Filesize
988KB

Download
memory/2636-149-0x0000000008710000-0x00000000087D3000-memory.dmp

Filesize
780KB

Download
memory/2636-159-0x0000000008FF0000-0x00000000090E7000-memory.dmp

Filesize
988KB

Download
memory/3220-150-0x0000000000640000-0x0000000000659000-memory.dmp

Filesize
100KB

Download
memory/3220-154-0x0000000002BA0000-0x0000000002EEA000-memory.dmp

Filesize
3.3MB

Download
memory/3220-153-0x0000000000C70000-0x0000000000C9D000-memory.dmp

Filesize
180KB

Download
memory/3220-156-0x00000000029C0000-0x0000000002A4F000-memory.dmp

Filesize
572KB

Download
memory/3220-152-0x0000000000640000-0x0000000000659000-memory.dmp

Filesize
100KB

Download