3632e05e0742cd8f5d764ecaf243796aeb11ba5dfa858d4a2a2fae1d04734dcb

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/03/2023, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nPAYMENT COPY.exe
Size 449KB
Sample230310-t1cymsgc8x
SHA256 3632e05e0742cd8f5d764ecaf243796aeb11ba5dfa858d4a2a2fae1d04734dcb
MD5 010510fa1699192fcf419d8d0979d326
SHA1 90e52323fbe695e19b12eb19abadd54140bc8bfa
SHA512 163f2ea50a79ece7d380d0d34224caab011ea7e6ee4900e184db602feb1f6119abc0478e5a2c5ab73ca8a02ac555f8103787dcad38050ec1b1e60d4acaa979e7
SSDEEP 6144:2Ya6r7pbu7cahyvQjwEPM9lKH9bZey354wS/yPulz75aWWvSZf:2YnQVhy7uMSdbZey3if/y2t9aLw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	664	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\International\Geo\Nation	spfxemttfw.exe

Executes dropped EXE 2 IoCs

pid	Process
1404	spfxemttfw.exe
1996	spfxemttfw.exe

Loads dropped DLL 4 IoCs

pid	Process
1376	nPAYMENT COPY.exe
1376	nPAYMENT COPY.exe
1404	spfxemttfw.exe
664	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 1996	1404	spfxemttfw.exe	29
PID 1996 set thread context of 1236	1996	spfxemttfw.exe	14
PID 664 set thread context of 1236	664	cmd.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3948302646-268491222-1934009652-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1996	spfxemttfw.exe
1996	spfxemttfw.exe
1996	spfxemttfw.exe
1996	spfxemttfw.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1236	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1404	spfxemttfw.exe
1996	spfxemttfw.exe
1996	spfxemttfw.exe
1996	spfxemttfw.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe
664	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	spfxemttfw.exe
Token: SeDebugPrivilege	664	cmd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1404	1376	nPAYMENT COPY.exe	28
PID 1376 wrote to memory of 1404	1376	nPAYMENT COPY.exe	28
PID 1376 wrote to memory of 1404	1376	nPAYMENT COPY.exe	28
PID 1376 wrote to memory of 1404	1376	nPAYMENT COPY.exe	28
PID 1404 wrote to memory of 1996	1404	spfxemttfw.exe	29
PID 1404 wrote to memory of 1996	1404	spfxemttfw.exe	29
PID 1404 wrote to memory of 1996	1404	spfxemttfw.exe	29
PID 1404 wrote to memory of 1996	1404	spfxemttfw.exe	29
PID 1404 wrote to memory of 1996	1404	spfxemttfw.exe	29
PID 1236 wrote to memory of 664	1236	Explorer.EXE	30
PID 1236 wrote to memory of 664	1236	Explorer.EXE	30
PID 1236 wrote to memory of 664	1236	Explorer.EXE	30
PID 1236 wrote to memory of 664	1236	Explorer.EXE	30
PID 664 wrote to memory of 576	664	cmd.exe	33
PID 664 wrote to memory of 576	664	cmd.exe	33
PID 664 wrote to memory of 576	664	cmd.exe	33
PID 664 wrote to memory of 576	664	cmd.exe	33
PID 664 wrote to memory of 576	664	cmd.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\nPAYMENT COPY.exe
  "C:\Users\Admin\AppData\Local\Temp\nPAYMENT COPY.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
    "C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe" C:\Users\Admin\AppData\Local\Temp\xzrym.t
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
      "C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dpitja.cp

Path C:\Users\Admin\AppData\Local\Temp\dpitja.cp
Size 205KB
SHA256 7ca8d817d6c32cefa8872e1d31ec84694440a301f5d1330217c5569774e6dc92
MD5 bedab9ae8e5cdc69d5cb83a001694e04
SHA1 72704a6f4251f8fd48ebe7bc61211e305d0f6cbf
SHA512 64159a0fcc2ec5d1ed221ac5a3458fccd8d9cbfcbd6854987775a74eecc759e5a75333a04a324f86991ac6b5e7b7d387952d98e59e8fde05c5cbf50dedc6794a
SSDEEP 3072:gjPepONSXyAYx90liSRiXlIf+5cNszLqudFAoHKqu/xhoKBU30XJRHzd:H4SXmpoiXl2+5cq1dFtH5k5RTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ef44-.zip

Path C:\Users\Admin\AppData\Local\Temp\ef44-.zip
Size 423KB
SHA256 052404f3ffa178f7e3c5353cfc361675661226d5e09984173ebda5c3ea1a229c
MD5 b722723b3142c9d0a3c65e2dabd8003f
SHA1 300ce0d33276b0e3cb78a69f83bf172f04fe10b3
SHA512 7d0740df1501d3804d608a0d728e854dec2524105ac765c1d7db996ce7b584cde085c6159596955c1029f6a8140ff24b0caf77900264022832a8e0e5cd69b78b
SSDEEP 6144:kwP65HSTsCkKYx4A98s7jCwKcPaWpCYZb+J8Xs3ybUQMjfLyeVN+g96zEeU+Lc4:ksKHSfCVFvCiNpCMTXeHZLLyNweUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path C:\Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

xzrym.t

Path C:\Users\Admin\AppData\Local\Temp\xzrym.t
Size 5KB
SHA256 1764c92545c4e0ce4584b6b507eff208e466398e29bb17b12371b1934617ffc1
MD5 83fdbf1ffe575a7636e3686d4a09a5dd
SHA1 75b33c714338f4205af1ff99dfa81448d1121e39
SHA512 eca6efe2b7b40ef1266a93d25b56bbdf6b71024d719c2ae0f6a59248af50be901139566916df601e60909e07437dbcca157036a5398a385257654db106753b7a
SSDEEP 96:Farc6oYmg/DrYu2k2XO5oSw04ZdahlAFZDmAqchqwkOgNcQXzL2gf:FarcReOhX1SJaasjo0e5Mgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path \Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path \Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spfxemttfw.exe

Path \Users\Admin\AppData\Local\Temp\spfxemttfw.exe
Size 52KB
SHA256 c1cda8b5d7ad7b6bf0fb72ed5e81eba949d3ac9564fe5f58c5d3cc624c21c62d
MD5 8c5a224a012ceed51a7331f83ceff97f
SHA1 f98b7e03786d64a0df2837a0a9c189ddae2602e5
SHA512 4873094ef7f351d119bb87058dd68a662d564aca83472102a973bab5e1d42ee494c14464ad783369e583ad6bdef41486fd745b741c3b78907ea30d1313a2abe2
SSDEEP 768:5InbnZTRSqFeviCOBQiNhhGtVd/1fVy3ReMyPNfmRQPBwEDbAntRZ/6qpB:5+ZlkviCOBDzotVd/oURdRPBStR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 810KB
SHA256 1b755cc3093dd45a0df857854aedfeb3c8f3622cff5bc491f2d492ebfa3ef8e0
MD5 c6ec991471d42128268ea10236d9cdb8
SHA1 d569350d02db6a118136220da8de40a9973084f1
SHA512 a67ed46547b9270c8a5a7a947b375cb6baf3211072f90170aae2bb6ce9c4fe9d7be3e9d782420dcfdbc19a1f232b3be561ca503b80e8dc3e036a62c54cad5b57
SSDEEP 24576:P5Ojm8loqaH3loJ6HyMn+ekHRT8bfENtXOv:PmSqaHyJ6HyM+ekHRT83
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/664-302-0x0000000061E00000-0x0000000061EB8000-memory.dmp

Download

memory/664-80-0x000000004A160000-0x000000004A1AC000-memory.dmp

Download

memory/664-297-0x0000000061E00000-0x0000000061EB8000-memory.dmp

Download

memory/664-85-0x0000000001D90000-0x0000000001E1F000-memory.dmp

Download

memory/664-82-0x0000000001FC0000-0x00000000022C3000-memory.dmp

Download

memory/664-81-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/664-78-0x000000004A160000-0x000000004A1AC000-memory.dmp

Download

memory/1236-83-0x0000000005EE0000-0x0000000005F74000-memory.dmp

Download

memory/1236-77-0x0000000002B10000-0x0000000002BFF000-memory.dmp

Download

memory/1236-135-0x0000000005EE0000-0x0000000005F74000-memory.dmp

Download

memory/1236-74-0x00000000038E0000-0x00000000039E0000-memory.dmp

Download

memory/1236-300-0x000007FF210D0000-0x000007FF210DA000-memory.dmp

Download

memory/1996-79-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1996-76-0x0000000000190000-0x00000000001A0000-memory.dmp

Download

memory/1996-75-0x0000000000800000-0x0000000000B03000-memory.dmp

Download

memory/1996-73-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1996-72-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1996-69-0x0000000000400000-0x000000000042F000-memory.dmp

Download