Overview

overview

8

Static

static

3

paypalmoneygen.exe

windows7-x64

8

paypalmoneygen.exe

windows10-2004-x64

8

Resubmissions

09/03/2024, 23:39

240309-3nca1seb46 8

09/03/2024, 23:35

240309-3lfknaee9s 8

09/03/2024, 23:31

240309-3hvkeadh98 8

09/03/2024, 23:29

240309-3gspesdh76 8

Analysis

  • max time kernel
    45s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 23:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    paypalmoneygen.exe

  • Size

    409KB

  • MD5

    aab68536e0cfbb3c3149a02021a09206

  • SHA1

    1f2a2e8517d764281b0e076cab5c98c4b9a2cb94

  • SHA256

    4364fdf8e6b7b58cbfc34aab3a86368c1c73467ec5d74847b07d72b50a99d3d7

  • SHA512

    e622a0797e3455fc213c2078ccc1cc5b769cd09d94d3c4acb140ca87fe607485ac919be83e1d7661199383bee0f3471a5653e6ef9800fde94230b7e3d3311659

  • SSDEEP

    12288:wORqrdkTyk4Osir2upORqrdOOsir2upORqrdHOsir2u:jiKJFfr2Pixfr2Pi4fr2

Score
8/10
persistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Loads dropped DLL 16 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 54 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\paypalmoneygen.exe
    "C:\Users\Admin\AppData\Local\Temp\paypalmoneygen.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3300
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x42c 0x300
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:832
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5040
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4488
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:672
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4080
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3816
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    PID:3720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SendNotifyMessage
    PID:4036
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3648
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1956
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1900
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4384
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2796
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:1788
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2300
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3032
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:676
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:5380
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:5652
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:5780
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:5104
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4104
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3764
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:5568
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:5924
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3956
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:5272
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:6024
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1600
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:5564
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:456

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                        Filesize

                                                        471B

                                                        MD5

                                                        94cb3d35c6757a6627b6810f0dba6730

                                                        SHA1

                                                        6e354e4685f7e35f004daf04702c3b1f41d78a38

                                                        SHA256

                                                        f6b05bec7203657825a9e0c5174f19a8681d6062b3deb03e118c54f472b33aed

                                                        SHA512

                                                        db3b46690dfe5cc2e4b4c56a62d88a72422c9c89dd380f58372f4d6dceab4e8f8b75690c004ec527087d373232fc1b1366f1fe86b80c94fe85b584a2da197902

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                        Filesize

                                                        412B

                                                        MD5

                                                        e30f5110491cef0f3104ec727deaf919

                                                        SHA1

                                                        f611dfbe4945df9f9c33cdb3ec3b3a6d7e838c05

                                                        SHA256

                                                        7c1ec4c894fe5aa5be13b774e9ee9d5991bd78605d0e215324df9dd1efccab8c

                                                        SHA512

                                                        ecf2fc62ec9a9c73efee8b031fd9b7a32e76afbee0f00555f0d838663e84c52d2ef1c178e8f454adb21eacab65faf1735abeeb020801004fe19ab618893dfaef

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\N3A1GXDL\microsoft.windows[1].xml
                                                        Filesize

                                                        97B

                                                        MD5

                                                        2a048584ff1532f817c94dc91dcd1288

                                                        SHA1

                                                        a8feaa50ff20598096757253f961ed62cc8e2569

                                                        SHA256

                                                        ac0e9ccd0c2a91247d80d72c35930928c1da245701ca832072bd977c61d3901a

                                                        SHA512

                                                        b6e50c342123202657e524ce15e02851da3b8573494e0ba98f7b70c6438fcbee100df4eac302d1dcbd3d3123bdf14a11d232c96d998c569431887317419c1d86

                                                        Download Submit

                                                      • C:\Windows\HookDLL64.dll
                                                        Filesize

                                                        137KB

                                                        MD5

                                                        453d2cdee9141c2b68cb1005252cbb38

                                                        SHA1

                                                        35a6104146f4dabb3a55b3b6b4adf5a1e50cbe7e

                                                        SHA256

                                                        c9382948f62a4505f5e4b7d9bebae020ecd1e39ea9758175f6c727306d826ec4

                                                        SHA512

                                                        43f9a3f67126d1950f0fde6e98d3171e005a9ef42ed68924cb893ba4ba2dbf8afba9b5c74430524bb6376fce892782667e3b3299a8db470025c7429f52202bf1

                                                        Download Submit

                                                      • memory/676-84-0x0000018422A80000-0x0000018422AA0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/676-88-0x0000018422E50000-0x0000018422E70000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/676-86-0x0000018422A40000-0x0000018422A60000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/832-6-0x00007FFAE31A0000-0x00007FFAE31A1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1600-182-0x0000000002E20000-0x0000000002E21000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1956-46-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2300-76-0x0000000002330000-0x0000000002331000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3720-34-0x000001C23BFE0000-0x000001C23BFE8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/3764-142-0x00000136DE4C0000-0x00000136DE4E0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3764-139-0x00000136DE500000-0x00000136DE520000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3764-144-0x00000136DEAE0000-0x00000136DEB00000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3956-160-0x0000000004370000-0x0000000004371000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4080-27-0x0000000004010000-0x0000000004011000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4384-55-0x0000025CB1DE0000-0x0000025CB1E00000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4384-52-0x0000025CB2020000-0x0000025CB2040000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4384-59-0x0000025CB23F0000-0x0000025CB2410000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5104-131-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/5380-103-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/5780-115-0x0000018386CE0000-0x0000018386D00000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5780-113-0x00000183866C0000-0x00000183866E0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5780-111-0x0000018386700000-0x0000018386720000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/6024-167-0x000002A06ADB0000-0x000002A06ADD0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/6024-170-0x000002A06AD70000-0x000002A06AD90000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/6024-172-0x000002A86C380000-0x000002A86C3A0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download