ce715834adfe198deca711272820821d7800c98ba421af235f32121709024fa7

General

Target

PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
Size

759KB
MD5

8112f2b670cb05ca4f3729228e580bdb
SHA1

cda41721469846c7d7ff46eeaaee59238ea613eb
SHA256

3954509f8c88aa06aa91564d36418ac72e9e03cb09a19778bb7521e2d0a8736a
SHA512

5070a005f092f122528994dfc2064892f27654c045835b86bfbc4813636808e24fe5b571b408c708d68ffa4e3c6a7e5da5f4ed945ebf917d0a6116f0a6022e8e
SSDEEP

12288:WbKpzN6SmqepTkUzxeJG5lTpktrcXntQ4HdpgfH5yMhC10zURZW:qKpESGTtxG81irYtQYdpWyb

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2564	proquota.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2596 set thread context of 2076	2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	27
PID 2596 set thread context of 1208	2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	21
PID 2596 set thread context of 2564	2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	31
PID 2564 set thread context of 1208	2564	proquota.exe	21

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	proquota.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
2596	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
1208	Explorer.EXE
1208	Explorer.EXE
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe
2564	proquota.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 2076 wrote to memory of 2596	2076	PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe	28
PID 1208 wrote to memory of 2564	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2564	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2564	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2564	1208	Explorer.EXE	31
PID 2564 wrote to memory of 1964	2564	proquota.exe	34
PID 2564 wrote to memory of 1964	2564	proquota.exe	34
PID 2564 wrote to memory of 1964	2564	proquota.exe	34
PID 2564 wrote to memory of 1964	2564	proquota.exe	34
PID 2564 wrote to memory of 1964	2564	proquota.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION URGENT ATTENTION NEEDED.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2596
- C:\Windows\SysWOW64\proquota.exe
  "C:\Windows\SysWOW64\proquota.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rr8htr.zip

Filesize
486KB

MD5
1e73cacce02ae20026a81f1e56416aa3

SHA1
f491a7301ce11cf11a92c0245c7e03d927422286

SHA256
0dd0dd38cde5a14e7d6d0830db62cc7037e521fd042b0b8da0763128b2c0b3f2

SHA512
afe77facd8b16cc744ac2277414ffaf83436999d15eb8ac707f8098e2f8ed4cb29b430392ebe46b7fa65b20730615bc33dee9416f7141da5032a630894980a0a

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
927KB

MD5
7fd80b1cc72dc580c02ca4cfbfb2592d

SHA1
18da905af878b27151b359cf1a7d0a650764e8a1

SHA256
1e6dccbdf8527abb53c289da920463b7895300d0d984cc7e91a3ecda4e673190

SHA512
13f7f29b5ed31c551aa5f27742557aa4d026a226087d6fcbca094819759ecc753a2c33b7422ae88dc6a4a0a966edb8485a18e59a0283ba2686cae5d78e0190a3

Download Submit
memory/1208-20-0x00000000090C0000-0x000000000A749000-memory.dmp

Filesize
22.5MB

Download
memory/1208-28-0x0000000004540000-0x0000000004609000-memory.dmp

Filesize
804KB

Download
memory/1208-29-0x0000000004540000-0x0000000004609000-memory.dmp

Filesize
804KB

Download
memory/1208-30-0x00000000090C0000-0x000000000A749000-memory.dmp

Filesize
22.5MB

Download
memory/1208-32-0x0000000004540000-0x0000000004609000-memory.dmp

Filesize
804KB

Download
memory/2076-5-0x0000000005CA0000-0x0000000005D28000-memory.dmp

Filesize
544KB

Download
memory/2076-2-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/2076-1-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-11-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-0-0x0000000000140000-0x0000000000204000-memory.dmp

Filesize
784KB

Download
memory/2076-13-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/2076-3-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/2076-15-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-4-0x0000000001EA0000-0x0000000001EB2000-memory.dmp

Filesize
72KB

Download
memory/2564-31-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2564-26-0x0000000000AF0000-0x0000000000DF3000-memory.dmp

Filesize
3.0MB

Download
memory/2564-27-0x0000000000990000-0x0000000000A2E000-memory.dmp

Filesize
632KB

Download
memory/2564-71-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/2564-21-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2564-22-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2564-25-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2596-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-24-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/2596-19-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/2596-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-14-0x00000000009D0000-0x0000000000CD3000-memory.dmp

Filesize
3.0MB

Download
memory/2596-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2596-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing