Overview
overview
3Static
static
3billing-ce-cp/.xml
windows7-x64
1billing-ce-cp/.xml
windows10-2004-x64
3billing-ce...er.jar
windows7-x64
1billing-ce...er.jar
windows10-2004-x64
1billing-ce-cp/.xml
windows7-x64
1billing-ce-cp/.xml
windows10-2004-x64
3billing-ce...26a.js
windows7-x64
1billing-ce...26a.js
windows10-2004-x64
1billing-ce...167.js
windows7-x64
1billing-ce...167.js
windows10-2004-x64
1billing-ce...3d.xml
windows7-x64
1billing-ce...3d.xml
windows10-2004-x64
3billing-ce...e7.xml
windows7-x64
1billing-ce...e7.xml
windows10-2004-x64
3billing-ce...1cb.js
windows7-x64
1billing-ce...1cb.js
windows10-2004-x64
1billing-ce...c2a.js
windows7-x64
1billing-ce...c2a.js
windows10-2004-x64
1billing-ce...112.js
windows7-x64
1billing-ce...112.js
windows10-2004-x64
1billing-ce...958.js
windows7-x64
1billing-ce...958.js
windows10-2004-x64
1billing-ce...b8.xml
windows7-x64
1billing-ce...b8.xml
windows10-2004-x64
3billing-ce...b4.xml
windows7-x64
1billing-ce...b4.xml
windows10-2004-x64
3billing-ce...2b.xml
windows7-x64
1billing-ce...2b.xml
windows10-2004-x64
3billing-ce...b76.js
windows7-x64
1billing-ce...b76.js
windows10-2004-x64
1billing-ce...48.vbs
windows7-x64
1billing-ce...48.vbs
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 17:45
Static task
static1
Behavioral task
behavioral1
Sample
billing-ce-cp/.xml
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
billing-ce-cp/.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
billing-ce-cp/.mvn/wrapper/maven-wrapper.jar
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
billing-ce-cp/.mvn/wrapper/maven-wrapper.jar
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
billing-ce-cp/.xml
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
billing-ce-cp/.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
billing-ce-cp/.svn/pristine/02/02395241e5276448ddfb37627c2cfd6f946d326a.js
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
billing-ce-cp/.svn/pristine/02/02395241e5276448ddfb37627c2cfd6f946d326a.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
billing-ce-cp/.svn/pristine/09/09225e90422df3279598d961d28c040a24100167.js
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
billing-ce-cp/.svn/pristine/09/09225e90422df3279598d961d28c040a24100167.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
billing-ce-cp/.svn/pristine/0e/0e5ec3ce511ed20d4adf01abf3fe8b4de3caf23d.xml
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
billing-ce-cp/.svn/pristine/0e/0e5ec3ce511ed20d4adf01abf3fe8b4de3caf23d.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
billing-ce-cp/.svn/pristine/19/192571290a9ffa871fe23122edddfab634c61ae7.xml
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
billing-ce-cp/.svn/pristine/19/192571290a9ffa871fe23122edddfab634c61ae7.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
billing-ce-cp/.svn/pristine/22/229e076ad7e176204c5108cf972590ea658051cb.js
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
billing-ce-cp/.svn/pristine/22/229e076ad7e176204c5108cf972590ea658051cb.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
billing-ce-cp/.svn/pristine/24/2450134711d3eb7e779346a6d47b56a26230fc2a.js
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
billing-ce-cp/.svn/pristine/24/2450134711d3eb7e779346a6d47b56a26230fc2a.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
billing-ce-cp/.svn/pristine/2b/2bd34639f0cd1d756a27afc6d44ba29c2182a112.js
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
billing-ce-cp/.svn/pristine/2b/2bd34639f0cd1d756a27afc6d44ba29c2182a112.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
billing-ce-cp/.svn/pristine/34/34bf30a6c5c9d46cdac4a9469cedcc3ff0e09958.js
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
billing-ce-cp/.svn/pristine/34/34bf30a6c5c9d46cdac4a9469cedcc3ff0e09958.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
billing-ce-cp/.svn/pristine/37/372924d0e561e64f1200690be39f3c797dbf95b8.xml
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
billing-ce-cp/.svn/pristine/37/372924d0e561e64f1200690be39f3c797dbf95b8.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
billing-ce-cp/.svn/pristine/5d/5da08716833222bf1e2070b041b094c43766d4b4.xml
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
billing-ce-cp/.svn/pristine/5d/5da08716833222bf1e2070b041b094c43766d4b4.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
billing-ce-cp/.svn/pristine/80/8040d33ff07ae7ca25253042c2dcfef37b32b12b.xml
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
billing-ce-cp/.svn/pristine/80/8040d33ff07ae7ca25253042c2dcfef37b32b12b.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
billing-ce-cp/.svn/pristine/80/80fbad6c51215de7679e680755a74e18d343db76.js
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
billing-ce-cp/.svn/pristine/80/80fbad6c51215de7679e680755a74e18d343db76.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
billing-ce-cp/.svn/pristine/9c/9c6d2f7349fb906818588a912e7676ba5fa98148.vbs
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
billing-ce-cp/.svn/pristine/9c/9c6d2f7349fb906818588a912e7676ba5fa98148.vbs
Resource
win10v2004-20230703-en
General
-
Target
billing-ce-cp/.svn/pristine/5d/5da08716833222bf1e2070b041b094c43766d4b4.xml
-
Size
1KB
-
MD5
ce77a25821b3fd9bad732d2401526821
-
SHA1
5da08716833222bf1e2070b041b094c43766d4b4
-
SHA256
e2bff5431105efbff71a3261292e978930c63d5048411db1b3fe342e9f39c679
-
SHA512
735af962c94aed56270583aa692e1c412bd05807b7a025a2bb825f585a9ab727ebf64e72891ee7a7d86b0163ae0dbd8a57d9ed7a1c4e92d8d14f32f0c03e9072
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2316 1372 WerFault.exe MSOXMLED.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\billing-ce-cp\.svn\pristine\5d\5da08716833222bf1e2070b041b094c43766d4b4.xml"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1372 -s 4522⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 1372 -ip 13721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1372-133-0x00007FFCCDA70000-0x00007FFCCDA80000-memory.dmpFilesize
64KB
-
memory/1372-134-0x00007FFD0D9F0000-0x00007FFD0DBE5000-memory.dmpFilesize
2.0MB
-
memory/1372-135-0x00007FFD0D9F0000-0x00007FFD0DBE5000-memory.dmpFilesize
2.0MB
-
memory/1372-136-0x00007FFD0B1B0000-0x00007FFD0B479000-memory.dmpFilesize
2.8MB
-
memory/1372-137-0x00007FFCCDA70000-0x00007FFCCDA80000-memory.dmpFilesize
64KB
-
memory/1372-138-0x00007FFD0D9F0000-0x00007FFD0DBE5000-memory.dmpFilesize
2.0MB