Overview

overview

10

Static

static

3

Payment Co...ls.exe

windows7-x64

3

Payment Co...ls.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2023, 08:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Payment Copy (Swift-TT).xls.exe
  • Size 2.8MB
  • Sample231024-kw59ysdf74
  • SHA256 04f59143e6d05f2b94cd081c398b7e4dc6ab486fa83e67194b13582faaa8727a
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:2636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:2660
    • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
      2⤵
        PID:2552
      • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
        "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
        2⤵
          PID:2768
        • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
          "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
          2⤵
            PID:2500
          • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
            "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
            2⤵
              PID:2508
            • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
              "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
              2⤵
                PID:2516
              • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
                "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
                2⤵
                  PID:2540
                • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
                  "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
                  2⤵
                    PID:2568
                  • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
                    "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
                    2⤵
                      PID:2616
                    • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
                      "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
                      2⤵
                        PID:2368
                      • C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe
                        "C:\Users\Admin\AppData\Local\Temp\Payment Copy (Swift-TT).xls.exe"
                        2⤵
                          PID:2896

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            memory/2864-1-0x00000000740E0000-0x00000000747CE000-memory.dmp
                            Download

                            memory/2864-0-0x0000000000150000-0x000000000041A000-memory.dmp
                            Download

                            memory/2864-2-0x00000000006E0000-0x0000000000720000-memory.dmp
                            Download

                            memory/2864-3-0x0000000000920000-0x000000000097A000-memory.dmp
                            Download

                            memory/2864-4-0x0000000000720000-0x0000000000762000-memory.dmp
                            Download

                            memory/2864-5-0x00000000008A0000-0x00000000008E0000-memory.dmp
                            Download

                            memory/2864-6-0x0000000002360000-0x00000000023AC000-memory.dmp
                            Download

                            memory/2864-7-0x00000000740E0000-0x00000000747CE000-memory.dmp
                            Download

                            memory/2864-8-0x00000000006E0000-0x0000000000720000-memory.dmp
                            Download

                            memory/2864-9-0x00000000740E0000-0x00000000747CE000-memory.dmp
                            Download