Overview
overview
3Static
static
3PayPal SoftWare.exe
windows7-x64
3PayPal SoftWare.exe
windows10-2004-x64
3libeay32.dll
windows7-x64
3libeay32.dll
windows10-2004-x64
3msvcr71.dll
windows7-x64
3msvcr71.dll
windows10-2004-x64
3ssleay32.dll
windows7-x64
3ssleay32.dll
windows10-2004-x64
3user34.dll
windows7-x64
3user34.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
PayPal SoftWare.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
PayPal SoftWare.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
libeay32.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
libeay32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
msvcr71.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
msvcr71.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ssleay32.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
ssleay32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
user34.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
user34.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
PayPal SoftWare.exe
-
Size
6.9MB
-
MD5
faafbeb06ef7da90ac83b842538f2246
-
SHA1
3569217799e151c0a74024ea2b57bbf75f1f219f
-
SHA256
3ca31cccbbd3cd5b3f3767da6cfbd498bf49d71c299f5d1e2f9e37699f3de8b5
-
SHA512
f6bd1540cf1996d94eea3496d726a3601be90b08e50528ca3212110167678ec296542990eb080d706fe50d06dec94ca9953572f4e6446ab76ccfbdf1c1ecead5
-
SSDEEP
196608:B7KL0FbkEFmZ7xJxAkkbqi4kxUVrwVeRDnVC:B7e0FIsmR+kViPUJwVe7V
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PayPal SoftWare.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3684 PayPal SoftWare.exe 3684 PayPal SoftWare.exe 3684 PayPal SoftWare.exe 3684 PayPal SoftWare.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2380 taskmgr.exe Token: SeSystemProfilePrivilege 2380 taskmgr.exe Token: SeCreateGlobalPrivilege 2380 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe 2380 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3684 PayPal SoftWare.exe 3684 PayPal SoftWare.exe 5008 StartMenuExperienceHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PayPal SoftWare.exe"C:\Users\Admin\AppData\Local\Temp\PayPal SoftWare.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3684
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2380
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5008