Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 05:52
Static task
static1
Behavioral task
behavioral1
Sample
proforma invoice..exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
proforma invoice..exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
proforma invoice..exe
-
Size
671KB
-
MD5
0e037a488e8b1ec0eb2d4d55462efb22
-
SHA1
d027a353ef0636a9e246dc472c570bde6756a6c7
-
SHA256
c7ed6d0c739775c06ddd97044b29ec6becc5adba3fa6d85ab7ef897682d9ec58
-
SHA512
b565ebdcce218c5759f76c7b77a0a4f9ae06afba90dece1224a97b333f0a848444a7712da66f6c7fe6e9339a9145f2363ffd547ae8fb958599b88a6ac0f8929b
Score
1/10
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
proforma invoice..exedescription pid process target process PID 1152 wrote to memory of 1992 1152 proforma invoice..exe schtasks.exe PID 1152 wrote to memory of 1992 1152 proforma invoice..exe schtasks.exe PID 1152 wrote to memory of 1992 1152 proforma invoice..exe schtasks.exe PID 1152 wrote to memory of 2008 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 2008 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 2008 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1852 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1852 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1852 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1932 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1932 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1932 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1856 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1856 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 1856 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 2012 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 2012 1152 proforma invoice..exe proforma invoice..exe PID 1152 wrote to memory of 2012 1152 proforma invoice..exe proforma invoice..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
proforma invoice..exedescription pid process Token: SeDebugPrivilege 1152 proforma invoice..exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
proforma invoice..exepid process 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe 1152 proforma invoice..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YpdlvrgJn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF852.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵