5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Payment Advice_pdf.exe
Size 352KB
Sample230321-l7dvhsbf71
SHA256 5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60
MD5 751555f7dc728acf20ae1c0c82bfb49e
SHA1 badc9a6e21f7436a87ce59c8c403c8f7238a2c3c
SHA512 333f1da0ba3ed877e512ab095224b2900118ef38ac8f0cd466a3b48b36bebde5c586858d21cc951dcc00465f86ee5b116f19d8b7b7a677b21526c66d41c53390
SSDEEP 6144:8Ya6YMc9O7tXxXD9YF7g/0jOaYXoGk+papuwJAYTmZk:8YmD9wXxT6a0aX1pJLYTN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	zhvmprl.exe

Executes dropped EXE 2 IoCs

pid	Process
1316	zhvmprl.exe
3884	zhvmprl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 3884	1316	zhvmprl.exe	87
PID 3884 set thread context of 3148	3884	zhvmprl.exe	35
PID 2068 set thread context of 3148	2068	cmstp.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3148	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1316	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
3884	zhvmprl.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe
2068	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	zhvmprl.exe
Token: SeDebugPrivilege	2068	cmstp.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1316	2024	HSBC Payment Advice_pdf.exe	85
PID 2024 wrote to memory of 1316	2024	HSBC Payment Advice_pdf.exe	85
PID 2024 wrote to memory of 1316	2024	HSBC Payment Advice_pdf.exe	85
PID 1316 wrote to memory of 3884	1316	zhvmprl.exe	87
PID 1316 wrote to memory of 3884	1316	zhvmprl.exe	87
PID 1316 wrote to memory of 3884	1316	zhvmprl.exe	87
PID 1316 wrote to memory of 3884	1316	zhvmprl.exe	87
PID 3148 wrote to memory of 2068	3148	Explorer.EXE	89
PID 3148 wrote to memory of 2068	3148	Explorer.EXE	89
PID 3148 wrote to memory of 2068	3148	Explorer.EXE	89
PID 2068 wrote to memory of 3704	2068	cmstp.exe	101
PID 2068 wrote to memory of 3704	2068	cmstp.exe	101
PID 2068 wrote to memory of 3704	2068	cmstp.exe	101

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
    "C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe" C:\Users\Admin\AppData\Local\Temp\tefxykcqz.nz
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
      "C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tefxykcqz.nz

Path C:\Users\Admin\AppData\Local\Temp\tefxykcqz.nz
Size 5KB
SHA256 ac5a8abcc894ba1d3d8c3e21761f7f7134a1a0b7ce03b4e5c720dc65f4a37a42
MD5 b7b8283d1b41609cc9e3e3cff57e5df2
SHA1 7d64fc4910751993e4b6c56b80182404b421947b
SHA512 aea534a84833e7e9c8896462f0b9e778cf884405cb553f2ed22b21a9fa70ffc1d4301f9af44ce09870ab0004c61a611050dfa9d35c8baf4888c09b30197ebf9a
SSDEEP 96:Farc6oYUg/DrYuok2XO5oSwsurucWd0Dg4ciOi0VxDI8u3Rumm88w5d8r1YZt:FarcRAghX1ShurtW0c4JOi0VG8RbAdeC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tovqtxebn.khf

Path C:\Users\Admin\AppData\Local\Temp\tovqtxebn.khf
Size 205KB
SHA256 7d2bd84f78916ee3a18e963362bd35235f521e0642db8ee504cc7803daf21a49
MD5 78e752262b553a21c677674fd1ba658c
SHA1 160b139dd654b3321e3ee0226822a265dc12943a
SHA512 6d7f4785ba314aa4cdc1169b467dac4fa98e166748808d076ed6fe3800655b2e835a7aaab85770627e716b5e58b7c2073036401cc820c3b463c3843122d31efd
SSDEEP 3072:tkPzVaoFT9shkvpwHJerC04mP0/sp7aPwTh8gR3MLUlgcDY8SCivSAewd/rumWw0:tkPn9s6vURA0b0zDLSLSARd/rvrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhvmprl.exe

Path C:\Users\Admin\AppData\Local\Temp\zhvmprl.exe
Size 5KB
SHA256 d78645c00c356477ea270ef7033058732b70ba2f9e0faf6ae9431e287fb51389
MD5 a408aeae8f93d7dc9d1f3fe25767322d
SHA1 982c3bba9bcab901528d7979690b29702bf34d05
SHA512 3f59132a01c5b7e5a6bee3d2fb07d36045b2f8abe1a03a4a216a2ef7fccd38b763f1b91b9a14af5c5d282afa45406e78ce9334d3a87ee2b663f5533f786a6477
SSDEEP 96:un8wZF3bluZzDCb5P4oyn/7JhpywpZ6uYHrAhBPxesU8:un8UF3bY1DYP4oynl/ycZ6uYHrSBwsU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1316-140-0x0000000000550000-0x0000000000552000-memory.dmp

Download

memory/2068-155-0x0000000002AA0000-0x0000000002DEA000-memory.dmp

Download

memory/2068-157-0x0000000002900000-0x000000000298F000-memory.dmp

Download

memory/2068-150-0x00000000001F0000-0x0000000000206000-memory.dmp

Download

memory/2068-153-0x00000000001F0000-0x0000000000206000-memory.dmp

Download

memory/2068-154-0x0000000000C00000-0x0000000000C2D000-memory.dmp

Download

memory/3148-161-0x0000000008240000-0x0000000008322000-memory.dmp

Download

memory/3148-159-0x0000000008140000-0x000000000823D000-memory.dmp

Download

memory/3148-156-0x0000000008240000-0x0000000008322000-memory.dmp

Download

memory/3148-149-0x0000000008140000-0x000000000823D000-memory.dmp

Download

memory/3884-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3884-146-0x0000000000B90000-0x0000000000EDA000-memory.dmp

Download

memory/3884-147-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3884-148-0x0000000000590000-0x00000000005A0000-memory.dmp

Download

memory/3884-145-0x0000000000400000-0x000000000042F000-memory.dmp

Download