238c224cf8d0b76532ae16f8a8d2682436a176909f382b8747e418f42ccaedeb

Analysis

Target
Invoice.exe
Size 535KB
Sample200720-6d4f8fr8bn
SHA256 238c224cf8d0b76532ae16f8a8d2682436a176909f382b8747e418f42ccaedeb
MD5 b4891e094082425b62776b6c7413f0e5
SHA1 6e5a056761a54e173601c57e26d867789707722e
SHA512 e2f17539d53204247390da76ed26412a18cdd545b05520be8758265c568c45b3211981845c1af63a4fcd8b700dca9a23fcde87d9052b168cbe4ce29eb6b2b79b
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1420	3848	Invoice.exe	68
PID 3848 wrote to memory of 1420	3848	Invoice.exe	68
PID 3848 wrote to memory of 1420	3848	Invoice.exe	68
PID 1420 wrote to memory of 2604	1420	avd.exe	71
PID 1420 wrote to memory of 2604	1420	avd.exe	71
PID 2604 wrote to memory of 2784	2604	cmd.exe	72
PID 2604 wrote to memory of 2784	2604	cmd.exe	72
PID 3848 wrote to memory of 3504	3848	Invoice.exe	73
PID 3848 wrote to memory of 3504	3848	Invoice.exe	73
PID 3848 wrote to memory of 3504	3848	Invoice.exe	73
PID 3504 wrote to memory of 3916	3504	cmd.exe	75
PID 3504 wrote to memory of 3916	3504	cmd.exe	75
PID 3504 wrote to memory of 3916	3504	cmd.exe	75
PID 3916 wrote to memory of 3884	3916	svchosts.sfx.exe	76
PID 3916 wrote to memory of 3884	3916	svchosts.sfx.exe	76
PID 3916 wrote to memory of 3884	3916	svchosts.sfx.exe	76

Executes dropped EXE 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1420	avd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	svchosts.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\avd.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\avd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D953.tmp\D954.tmp\D955.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\avd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d "1" /f
      4⤵
      PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\op.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchosts.sfx.exe
    svchosts.sfx.exe -dC:\Users\Admin\AppData\Local\Temp
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\svchosts.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\svchosts.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3884