Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 15:09
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice 20200619.exe
Resource
win7
Behavioral task
behavioral2
Sample
Proforma Invoice 20200619.exe
Resource
win10
General
-
Target
Proforma Invoice 20200619.exe
-
Size
619KB
-
MD5
0c55c4e607abb7f6c593d6d8dc140a0a
-
SHA1
6e50f8fcf9ec02aeee70b4ce14bd44a45b29bd32
-
SHA256
d22cd7fc720b7fc65ab0ec5a50e8dbde8c58c499ec5c289c0e1614f24d6255f8
-
SHA512
713facdb87ef95d5a569ebd69067101c25a0dd3ef65af778fcefb8dffb070580badd084a4cc86bc0130e35c23f17b5a71d3fcecb3ba9a88383d14d557a6b7371
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Proforma Invoice 20200619.exeRegAsm.exedescription pid process target process PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1316 wrote to memory of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe PID 1464 wrote to memory of 1032 1464 RegAsm.exe REG.exe PID 1464 wrote to memory of 1032 1464 RegAsm.exe REG.exe PID 1464 wrote to memory of 1032 1464 RegAsm.exe REG.exe PID 1464 wrote to memory of 1032 1464 RegAsm.exe REG.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proforma Invoice 20200619.exedescription pid process target process PID 1316 set thread context of 1464 1316 Proforma Invoice 20200619.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1464 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 1464 RegAsm.exe 1464 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1464 RegAsm.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Proforma Invoice 20200619.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\mediafiles = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\mediafile.exe" Proforma Invoice 20200619.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Disables Task Manager via registry modification
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Proforma Invoice 20200619.exepid process 1316 Proforma Invoice 20200619.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 20200619.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 20200619.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-4-0x0000000000000000-mapping.dmp
-
memory/1464-0-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1464-1-0x000000000044B93E-mapping.dmp
-
memory/1464-2-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1464-3-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB