Overview

overview

7

Static

static

1

Invoice 65...74.exe

windows7_x64

7

Invoice 65...74.exe

windows10_x64

7

Analysis

  • max time kernel
    15s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-02-2021 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice 6500TH21Y5674.exe

  • Size

    209KB

  • MD5

    dc22d7783144cfe4dcbb4734ed6a3656

  • SHA1

    65d3e4f4df34bb25f7b621dd0457c641f98029cb

  • SHA256

    c9fc9a54366452a99c7ed753c7f5055141bc579b1a2530f8db7d7a039db6225d

  • SHA512

    908395a21d0a9411d8d2839b7c952f1cf50fd1998c5325457913cc27b581719d890919c196460ce5eb9fadba874b40043a537e8e40ff6aac75fd0dffcae7be4c

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice 6500TH21Y5674.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice 6500TH21Y5674.exe"
    1⤵
    • Loads dropped DLL
    PID:1048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 912
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ir9ehshgyir.dll
    MD5

    27352d6a2da80c7a04c0a589e7f025bd

    SHA1

    500b490b02ee59deee00feb4c59a9f0308464e5c

    SHA256

    427ab077a32d2844f5e82a1d0c52b9fa73bb58298dc70b3d3a55ba05552dd840

    SHA512

    5afc122644ca2d1b2f9594adf653be281001c6c4e4d6d31b55950b83c64a1434b63054594b575510a9fa707d33e22624f01e92f5da2572712e364c7e1c21108b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\ir9ehshgyir.dll
    MD5

    27352d6a2da80c7a04c0a589e7f025bd

    SHA1

    500b490b02ee59deee00feb4c59a9f0308464e5c

    SHA256

    427ab077a32d2844f5e82a1d0c52b9fa73bb58298dc70b3d3a55ba05552dd840

    SHA512

    5afc122644ca2d1b2f9594adf653be281001c6c4e4d6d31b55950b83c64a1434b63054594b575510a9fa707d33e22624f01e92f5da2572712e364c7e1c21108b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsmA407.tmp\System.dll
    MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

    SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    Download Submit
  • memory/996-4-0x00000000047F0000-0x00000000047F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/996-5-0x00000000047F0000-0x00000000047F1000-memory.dmp
    Filesize

    4KB

    Download