Analysis
- max time kernel
75s - max time network
112s - platform
windows10_x64 - resource
win10v200722 - submitted
10/09/2020, 15:27
General
- Target Invoice_BNS1.exe
- Size 913KB
- Sample200910-52rn4aepa2
- SHA256 fcbe71082a3592c66d1c16e331ee3af753087b46c63a118cab63cc5869e65b9a
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice_BNS1.exe"C:\Users\Admin\AppData\Local\Temp\Invoice_BNS1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3952-0-0x00000000740A0000-0x000000007478E000-memory.dmp
memory/3952-1-0x0000000000670000-0x0000000000671000-memory.dmp
memory/3952-3-0x0000000005730000-0x0000000005731000-memory.dmp
memory/3952-4-0x0000000005050000-0x0000000005051000-memory.dmp
memory/3952-5-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/3952-6-0x0000000006E30000-0x0000000006EB6000-memory.dmp
memory/3952-7-0x00000000075C0000-0x00000000075C1000-memory.dmp