Analysis
-
max time kernel
106s -
max time network
114s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
29-03-2020 21:47
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE AND PACKING LIST PDF.exe
Resource
win7v200217
windows7_x64
0 signatures
0 seconds
General
-
Target
INVOICE AND PACKING LIST PDF.exe
-
Size
824KB
-
MD5
51a4abeb33785f07ea531248035bf602
-
SHA1
671cbb4a7341d7ca9138c87f22c517b8a54c126f
-
SHA256
13b46d9524b436eb825c317fde69b0710f295ab95ead1e9d5c4babe39d9287f8
-
SHA512
fb6d606492aec3e5ba74c804627a856a10b01b815f65cdcf2b439253b88263d5c0f172a8a173079d3306d4625a73105d25243024ae1c2e63ca7df08aefb70880
Malware Config
Signatures
-
Loads dropped DLL 83 IoCs
Processes:
INVOICE AND PACKING LIST PDF.exepid process 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe 1860 INVOICE AND PACKING LIST PDF.exe -
Drops startup file 1 IoCs
Processes:
INVOICE AND PACKING LIST PDF.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk INVOICE AND PACKING LIST PDF.exe -
Drops file in Program Files directory 388 IoCs
Processes:
INVOICE AND PACKING LIST PDF.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\vLICLUA.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX8F3A.tmp INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX8F6A.tmp INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\vkinit.ico INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\DW\vDW20.ico INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPSVC.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\vklist.ico INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\vlauncher.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOICONS.EXE INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vwsgen.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjps.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\vODeploy.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjarsigner.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCX9741.tmp INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjvisualvm.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\vlauncher.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\7-Zip\7zG.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjabswitch.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX92A8.tmp INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX955B.tmp INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\7-Zip\v7z.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\vcom.oracle.jmc.executable.win32.win32.x86_64_5.5.0 INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\7-Zip\v7zFM.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vrmid.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vwsimport.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\DW\vDW20.EXE INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPREARM.EXE INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjstatd.ico INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\vjava-rmi.ico INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe INVOICE AND PACKING LIST PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe INVOICE AND PACKING LIST PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe INVOICE AND PACKING LIST PDF.exe -
Drops file in Windows directory 1 IoCs
Processes:
INVOICE AND PACKING LIST PDF.exedescription ioc process File opened for modification C:\Windows\bfsvc.exe INVOICE AND PACKING LIST PDF.exe -
Processes:
INVOICE AND PACKING LIST PDF.exedescription ioc process File opened for modification C:\autorun.inf INVOICE AND PACKING LIST PDF.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files\7-Zip\v7z.exe
-
\Program Files\7-Zip\v7zFM.exe
-
\Program Files\7-Zip\v7zG.exe
-
\Program Files\7-Zip\vUninstall.exe
-
\Program Files\Common Files\Microsoft Shared\DW\vDW20.EXE
-
\Program Files\Common Files\Microsoft Shared\DW\vDWTRIG20.EXE
-
\Program Files\Common Files\Microsoft Shared\EQUATION\vEQNEDT32.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\vODeploy.exe
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\vSetup.exe
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vFLTLDR.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vLICLUA.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOICONS.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOXMLED.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vOarpmany.exe
-
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPREARM.EXE
-
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPSVC.EXE
-
\Program Files\Common Files\Microsoft Shared\Smart Tag\vSmartTagInstall.exe
-
\Program Files\Common Files\Microsoft Shared\Source Engine\vOSE.EXE
-
\Program Files\Java\jdk1.7.0_80\bin\vappletviewer.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vapt.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vextcheck.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vidlj.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjabswitch.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjar.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjarsigner.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjava-rmi.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjava.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavac.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavadoc.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavafxpackager.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavah.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavap.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavaw.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavaws.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjcmd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjconsole.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjdb.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjhat.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjinfo.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjmap.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjmc.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjps.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjrunscript.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjsadebugd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstack.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstat.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstatd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjvisualvm.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vkeytool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vkinit.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vklist.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vktab.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vnative2ascii.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vorbd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vpack200.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vpolicytool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmic.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmid.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmiregistry.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vschemagen.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vserialver.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vservertool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vtnameserv.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vunpack200.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vwsgen.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vwsimport.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vxjc.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjabswitch.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjava-rmi.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjava.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavacpl.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavaw.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavaws.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjp2launcher.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vkeytool.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vkinit.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vklist.exe
-
\Program Files\Java\jdk1.7.0_80\jre\lib\vlauncher.exe
-
\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\vnbexec.exe
-
\Program Files\Java\jre7\bin\vjabswitch.exe
-
\Program Files\Microsoft Office\Office14\vACCICONS.EXE
-
\Program Files\VideoLAN\VLC\vuninstall.exe
-
\Users\Admin\AppData\Roaming\Paint.exe