Analysis
-
max time kernel
147s -
max time network
64s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 09:09
Static task
static1
Behavioral task
behavioral1
Sample
Payment Invoice.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment Invoice.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Payment Invoice.exe
-
Size
336KB
-
MD5
22997b8feb197ffc197b427c00c28f14
-
SHA1
74e8887e1629767090f7ed4e3f8abd92e718819f
-
SHA256
44703eacf8321a8fd05283f755a781a7cb17a55961159ab28d570c2196a79eb7
-
SHA512
d80e15c042f71675ccf50b93201aac64722c5b6a844c9c19e79eb330eda5c4e4fa09052a33399da3a6889779a823b4f824f442ba28594e790c3d254d9ab16477
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment Invoice.exePayment Invoice.execmstp.exedescription pid process target process PID 1108 set thread context of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 912 set thread context of 1284 912 Payment Invoice.exe Explorer.EXE PID 1512 set thread context of 1284 1512 cmstp.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment Invoice.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 912 Payment Invoice.exe Token: SeDebugPrivilege 1512 cmstp.exe Token: SeShutdownPrivilege 1284 Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1700 cmd.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Payment Invoice.exeExplorer.EXEcmstp.exedescription pid process target process PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1108 wrote to memory of 912 1108 Payment Invoice.exe Payment Invoice.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1284 wrote to memory of 1512 1284 Explorer.EXE cmstp.exe PID 1512 wrote to memory of 1700 1512 cmstp.exe cmd.exe PID 1512 wrote to memory of 1700 1512 cmstp.exe cmd.exe PID 1512 wrote to memory of 1700 1512 cmstp.exe cmd.exe PID 1512 wrote to memory of 1700 1512 cmstp.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Payment Invoice.execmstp.exepid process 912 Payment Invoice.exe 912 Payment Invoice.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe 1512 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment Invoice.execmstp.exepid process 912 Payment Invoice.exe 912 Payment Invoice.exe 912 Payment Invoice.exe 1512 cmstp.exe 1512 cmstp.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-2-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/912-3-0x000000000041E2C0-mapping.dmp
-
memory/1108-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1512-4-0x0000000000000000-mapping.dmp
-
memory/1512-5-0x0000000000920000-0x0000000000938000-memory.dmpFilesize
96KB
-
memory/1512-7-0x0000000000470000-0x0000000000511000-memory.dmpFilesize
644KB
-
memory/1700-6-0x0000000000000000-mapping.dmp