Analysis
-
max time kernel
132s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:56
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Invoice.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Invoice.exe
-
Size
1.6MB
-
MD5
d4604f538dbc3479d165a22cf8580259
-
SHA1
22c77149d40ab5d6b5bda86732d53bb877a1b1db
-
SHA256
fcd58c353ee45e7f1f7edfb1e2e207deb118a08b5350d8f1fdc76be5f051e792
-
SHA512
c60510d1414cf987fd0d563e7ed4bb4a8d6b5dd19fb39caaf47db7cef8b5d6ea860f3b663175f1428367a472e5b11d1009b5e200d9a8681e76175c8aea3d2c82
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Invoice.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice.exe\"" Invoice.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Invoice.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Invoice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Invoice.exe -
Drops startup file 2 IoCs
Processes:
Invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice.exe Invoice.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice.exe Invoice.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Invoice.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice.exe" Invoice.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Invoice.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice.exe" Invoice.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Invoice.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Invoice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Invoice.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1404-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1404-3-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/1404-5-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/1404-6-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/1404-7-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/1404-8-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/1404-9-0x0000000005790000-0x00000000057CC000-memory.dmpFilesize
240KB
-
memory/1404-10-0x0000000005F60000-0x0000000005F61000-memory.dmpFilesize
4KB