Analysis
-
max time kernel
132s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 15:09
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice 20200619.exe
Resource
win7
Behavioral task
behavioral2
Sample
Proforma Invoice 20200619.exe
Resource
win10
General
-
Target
Proforma Invoice 20200619.exe
-
Size
619KB
-
MD5
0c55c4e607abb7f6c593d6d8dc140a0a
-
SHA1
6e50f8fcf9ec02aeee70b4ce14bd44a45b29bd32
-
SHA256
d22cd7fc720b7fc65ab0ec5a50e8dbde8c58c499ec5c289c0e1614f24d6255f8
-
SHA512
713facdb87ef95d5a569ebd69067101c25a0dd3ef65af778fcefb8dffb070580badd084a4cc86bc0130e35c23f17b5a71d3fcecb3ba9a88383d14d557a6b7371
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1504 3928 WerFault.exe RegAsm.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Disables Task Manager via registry modification
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Proforma Invoice 20200619.exeRegAsm.exedescription pid process target process PID 4032 wrote to memory of 3928 4032 Proforma Invoice 20200619.exe RegAsm.exe PID 4032 wrote to memory of 3928 4032 Proforma Invoice 20200619.exe RegAsm.exe PID 4032 wrote to memory of 3928 4032 Proforma Invoice 20200619.exe RegAsm.exe PID 4032 wrote to memory of 3928 4032 Proforma Invoice 20200619.exe RegAsm.exe PID 3928 wrote to memory of 3692 3928 RegAsm.exe REG.exe PID 3928 wrote to memory of 3692 3928 RegAsm.exe REG.exe PID 3928 wrote to memory of 3692 3928 RegAsm.exe REG.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proforma Invoice 20200619.exedescription pid process target process PID 4032 set thread context of 3928 4032 Proforma Invoice 20200619.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
RegAsm.exeWerFault.exepid process 3928 RegAsm.exe 3928 RegAsm.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Proforma Invoice 20200619.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\mediafiles = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\mediafile.exe" Proforma Invoice 20200619.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Proforma Invoice 20200619.exepid process 4032 Proforma Invoice 20200619.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3928 RegAsm.exe Token: SeRestorePrivilege 1504 WerFault.exe Token: SeBackupPrivilege 1504 WerFault.exe Token: SeDebugPrivilege 1504 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 20200619.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 20200619.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 15443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-3-0x0000000004860000-0x0000000004861000-memory.dmpFilesize
4KB
-
memory/1504-15-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3692-2-0x0000000000000000-mapping.dmp
-
memory/3928-8-0x000000000044B93E-mapping.dmp
-
memory/3928-4-0x000000000044B93E-mapping.dmp
-
memory/3928-5-0x000000000044B93E-mapping.dmp
-
memory/3928-6-0x000000000044B93E-mapping.dmp
-
memory/3928-7-0x000000000044B93E-mapping.dmp
-
memory/3928-0-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3928-9-0x000000000044B93E-mapping.dmp
-
memory/3928-10-0x000000000044B93E-mapping.dmp
-
memory/3928-11-0x000000000044B93E-mapping.dmp
-
memory/3928-12-0x000000000044B93E-mapping.dmp
-
memory/3928-13-0x000000000044B93E-mapping.dmp
-
memory/3928-14-0x000000000044B93E-mapping.dmp
-
memory/3928-1-0x000000000044B93E-mapping.dmp