Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 06:27
Static task
static1
Behavioral task
behavioral1
Sample
payment invoice.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment invoice.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
payment invoice.exe
-
Size
296KB
-
MD5
630ff7654144a9486c7553548b5c2b9c
-
SHA1
74ef29a37e96cedaadd988cd7d157f844b90f611
-
SHA256
8463a584e6cc9d88c4971255edb22b51b3b89a8b87fce207b80d1adf61d5fcce
-
SHA512
e833916257f1162c716922813b7aff0e942a7ec47fd9447e12757e24044c3db15cded443b0e7e1e98339ad3b4154c8818fdc73efd7c57c69fb71c935bc638ecb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
payment invoice.exepayment invoice.exemsiexec.exedescription pid process target process PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1360 wrote to memory of 1804 1360 payment invoice.exe payment invoice.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1804 wrote to memory of 1832 1804 payment invoice.exe msiexec.exe PID 1832 wrote to memory of 1740 1832 msiexec.exe cmd.exe PID 1832 wrote to memory of 1740 1832 msiexec.exe cmd.exe PID 1832 wrote to memory of 1740 1832 msiexec.exe cmd.exe PID 1832 wrote to memory of 1740 1832 msiexec.exe cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
payment invoice.exepayment invoice.exemsiexec.exedescription pid process target process PID 1360 set thread context of 1804 1360 payment invoice.exe payment invoice.exe PID 1804 set thread context of 1324 1804 payment invoice.exe Explorer.EXE PID 1804 set thread context of 1324 1804 payment invoice.exe Explorer.EXE PID 1832 set thread context of 1324 1832 msiexec.exe Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
payment invoice.exemsiexec.exepid process 1804 payment invoice.exe 1804 payment invoice.exe 1804 payment invoice.exe 1804 payment invoice.exe 1832 msiexec.exe 1832 msiexec.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1740 cmd.exe -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
payment invoice.exemsiexec.exepid process 1804 payment invoice.exe 1804 payment invoice.exe 1804 payment invoice.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe 1832 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment invoice.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1804 payment invoice.exe Token: SeDebugPrivilege 1832 msiexec.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1324-8-0x0000000007360000-0x0000000007D24000-memory.dmpFilesize
9.8MB
-
memory/1360-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1740-6-0x0000000000000000-mapping.dmp
-
memory/1804-2-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1804-3-0x000000000041E330-mapping.dmp
-
memory/1832-4-0x0000000000000000-mapping.dmp
-
memory/1832-5-0x00000000005F0000-0x0000000000604000-memory.dmpFilesize
80KB
-
memory/1832-7-0x0000000003160000-0x00000000032D5000-memory.dmpFilesize
1.5MB