5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Payment Advice_pdf.exe
Size 352KB
Sample230321-l7dvhsbf71
SHA256 5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60
MD5 751555f7dc728acf20ae1c0c82bfb49e
SHA1 badc9a6e21f7436a87ce59c8c403c8f7238a2c3c
SHA512 333f1da0ba3ed877e512ab095224b2900118ef38ac8f0cd466a3b48b36bebde5c586858d21cc951dcc00465f86ee5b116f19d8b7b7a677b21526c66d41c53390
SSDEEP 6144:8Ya6YMc9O7tXxXD9YF7g/0jOaYXoGk+papuwJAYTmZk:8YmD9wXxT6a0aX1pJLYTN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\International\Geo\Nation	zhvmprl.exe

Executes dropped EXE 2 IoCs

pid	Process
1684	zhvmprl.exe
1824	zhvmprl.exe

Loads dropped DLL 4 IoCs

pid	Process
1924	HSBC Payment Advice_pdf.exe
1924	HSBC Payment Advice_pdf.exe
1684	zhvmprl.exe
1156	wuapp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 1824	1684	zhvmprl.exe	28
PID 1824 set thread context of 1200	1824	zhvmprl.exe	14
PID 1156 set thread context of 1200	1156	wuapp.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1914912747-3343861975-731272777-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wuapp.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1824	zhvmprl.exe
1824	zhvmprl.exe
1824	zhvmprl.exe
1824	zhvmprl.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1684	zhvmprl.exe
1824	zhvmprl.exe
1824	zhvmprl.exe
1824	zhvmprl.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe
1156	wuapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	zhvmprl.exe
Token: SeDebugPrivilege	1156	wuapp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1684	1924	HSBC Payment Advice_pdf.exe	26
PID 1924 wrote to memory of 1684	1924	HSBC Payment Advice_pdf.exe	26
PID 1924 wrote to memory of 1684	1924	HSBC Payment Advice_pdf.exe	26
PID 1924 wrote to memory of 1684	1924	HSBC Payment Advice_pdf.exe	26
PID 1684 wrote to memory of 1824	1684	zhvmprl.exe	28
PID 1684 wrote to memory of 1824	1684	zhvmprl.exe	28
PID 1684 wrote to memory of 1824	1684	zhvmprl.exe	28
PID 1684 wrote to memory of 1824	1684	zhvmprl.exe	28
PID 1684 wrote to memory of 1824	1684	zhvmprl.exe	28
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1200 wrote to memory of 1156	1200	Explorer.EXE	29
PID 1156 wrote to memory of 2032	1156	wuapp.exe	32
PID 1156 wrote to memory of 2032	1156	wuapp.exe	32
PID 1156 wrote to memory of 2032	1156	wuapp.exe	32
PID 1156 wrote to memory of 2032	1156	wuapp.exe	32
PID 1156 wrote to memory of 2032	1156	wuapp.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
    "C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe" C:\Users\Admin\AppData\Local\Temp\tefxykcqz.nz
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
      "C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- C:\Windows\SysWOW64\wuapp.exe
  "C:\Windows\SysWOW64\wuapp.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tefxykcqz.nz

Path C:\Users\Admin\AppData\Local\Temp\tefxykcqz.nz
Size 5KB
SHA256 ac5a8abcc894ba1d3d8c3e21761f7f7134a1a0b7ce03b4e5c720dc65f4a37a42
MD5 b7b8283d1b41609cc9e3e3cff57e5df2
SHA1 7d64fc4910751993e4b6c56b80182404b421947b
SHA512 aea534a84833e7e9c8896462f0b9e778cf884405cb553f2ed22b21a9fa70ffc1d4301f9af44ce09870ab0004c61a611050dfa9d35c8baf4888c09b30197ebf9a
SSDEEP 96:Farc6oYUg/DrYuok2XO5oSwsurucWd0Dg4ciOi0VxDI8u3Rumm88w5d8r1YZt:FarcRAghX1ShurtW0c4JOi0VG8RbAdeC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tovqtxebn.khf

Path C:\Users\Admin\AppData\Local\Temp\tovqtxebn.khf
Size 205KB
SHA256 7d2bd84f78916ee3a18e963362bd35235f521e0642db8ee504cc7803daf21a49
MD5 78e752262b553a21c677674fd1ba658c
SHA1 160b139dd654b3321e3ee0226822a265dc12943a
SHA512 6d7f4785ba314aa4cdc1169b467dac4fa98e166748808d076ed6fe3800655b2e835a7aaab85770627e716b5e58b7c2073036401cc820c3b463c3843122d31efd
SSDEEP 3072:tkPzVaoFT9shkvpwHJerC04mP0/sp7aPwTh8gR3MLUlgcDY8SCivSAewd/rumWw0:tkPn9s6vURA0b0zDLSLSARd/rvrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtx48.zip

Path C:\Users\Admin\AppData\Local\Temp\wtx48.zip
Size 472KB
SHA256 e1090bd71e36c943af572d13d23adcb824a38d01d8ec110bb63f29b5c9a26031
MD5 f24f874f0a201b7c919019d8cc45cc5a
SHA1 c2f99e749ce8b66b9da7cd793dc9b254c395f8c5
SHA512 5c40b2c48e598d30e3f47c67479dc19352080a16ccf7a7eff7034e595cad1643308c070d3ac4f4fed7bcc99f4a507bc5463c7944d81baa8f0b65b3e3a839140a
SSDEEP 12288:WdjLf8SN3B/xw/I7KGZYXvBUIxf4gcc/fzGwgz2FK8V+E46XX:1qxewQTygJfzGwgz2b46XX
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 902KB
SHA256 0815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda
MD5 50338cc1fa2582fa0cad8a8fa7ceb4d2
SHA1 ae697ef05b6bec38fb79ff4512ae50a303dcdbce
SHA512 02a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61
SSDEEP 24576:7q9u+M0agNmXiO2qajLN4X/wts8jdhuMTjw+Q/F0:7qnjJK2LjLN4X/wts8jdcMYk
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path \Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path \Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path \Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1156-81-0x0000000000A20000-0x0000000000D23000-memory.dmp

Download

memory/1156-82-0x0000000000920000-0x00000000009AF000-memory.dmp

Download

memory/1156-130-0x0000000061E00000-0x0000000061ECD000-memory.dmp

Download

memory/1156-125-0x0000000061E00000-0x0000000061ECD000-memory.dmp

Download

memory/1156-77-0x0000000001100000-0x000000000110B000-memory.dmp

Download

memory/1156-79-0x0000000001100000-0x000000000110B000-memory.dmp

Download

memory/1156-80-0x0000000000090000-0x00000000000BD000-memory.dmp

Download

memory/1200-86-0x0000000005030000-0x00000000050C6000-memory.dmp

Download

memory/1200-83-0x0000000005030000-0x00000000050C6000-memory.dmp

Download

memory/1200-75-0x0000000003950000-0x0000000003A2F000-memory.dmp

Download

memory/1824-72-0x0000000000990000-0x0000000000C93000-memory.dmp

Download

memory/1824-73-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1824-71-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1824-68-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1824-74-0x0000000000290000-0x00000000002A0000-memory.dmp

Download