Analysis
- max time kernel
150s - max time network
101s - platform
windows7_x64 - resource
win7 - submitted
15/07/2020, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
Invoice For H sbc Payment Instruction.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Invoice For H sbc Payment Instruction.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Invoice For H sbc Payment Instruction.exe
- Size 340KB
- Sample200715-m2x7ecln4e
- SHA256 d0604fe76ff35e2311825f1822171208bd472c764dfbdbf45e20fad47f6a4472
- MD5 d94d1332d48398914da9f4b343c528e2
- SHA1 8743bccc3cd8c5732470d831f90e614764068171
- SHA512 33b1548584a316cb09bacfbb79bbce37800eb62441459766a75e943789c1c74bd991c549bc456a010826e87823145912f22ea9f3c6e745696c26b4066b48f5d0
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1496 Invoice For H sbc Payment Instruction.exe 1820 RegAsm.exe 1820 RegAsm.exe 1820 RegAsm.exe 1824 chkdsk.exe 1824 chkdsk.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1496 set thread context of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1820 set thread context of 1268 1820 RegAsm.exe 20 PID 1824 set thread context of 1268 1824 chkdsk.exe 20 - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1496 wrote to memory of 1820 1496 Invoice For H sbc Payment Instruction.exe 24 PID 1268 wrote to memory of 1824 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1824 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1824 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1824 1268 Explorer.EXE 25 PID 1824 wrote to memory of 1852 1824 chkdsk.exe 26 PID 1824 wrote to memory of 1852 1824 chkdsk.exe 26 PID 1824 wrote to memory of 1852 1824 chkdsk.exe 26 PID 1824 wrote to memory of 1852 1824 chkdsk.exe 26 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1820 RegAsm.exe Token: SeDebugPrivilege 1824 chkdsk.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe Invoice For H sbc Payment Instruction.exe - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1820 RegAsm.exe 1820 RegAsm.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe 1824 chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\Invoice For H sbc Payment Instruction.exe"C:\Users\Admin\AppData\Local\Temp\Invoice For H sbc Payment Instruction.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Drops startup file
PID:1496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1852
-
-