Analysis
-
max time kernel
135s -
max time network
50s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 05:52
Static task
static1
Behavioral task
behavioral1
Sample
proforma invoice..exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
proforma invoice..exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
proforma invoice..exe
-
Size
671KB
-
MD5
0e037a488e8b1ec0eb2d4d55462efb22
-
SHA1
d027a353ef0636a9e246dc472c570bde6756a6c7
-
SHA256
c7ed6d0c739775c06ddd97044b29ec6becc5adba3fa6d85ab7ef897682d9ec58
-
SHA512
b565ebdcce218c5759f76c7b77a0a4f9ae06afba90dece1224a97b333f0a848444a7712da66f6c7fe6e9339a9145f2363ffd547ae8fb958599b88a6ac0f8929b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
proforma invoice..exedescription pid process target process PID 1516 wrote to memory of 2152 1516 proforma invoice..exe schtasks.exe PID 1516 wrote to memory of 2152 1516 proforma invoice..exe schtasks.exe PID 1516 wrote to memory of 2680 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2680 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2692 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2692 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2840 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2840 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2848 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2848 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2868 1516 proforma invoice..exe proforma invoice..exe PID 1516 wrote to memory of 2868 1516 proforma invoice..exe proforma invoice..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
proforma invoice..exedescription pid process Token: SeDebugPrivilege 1516 proforma invoice..exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
proforma invoice..exepid process 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe 1516 proforma invoice..exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YpdlvrgJn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB06A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice..exe"{path}"2⤵