Analysis
- max time kernel
43s - max time network
11s - platform
windows7_x64 - resource
win7v20210410 - submitted
05/05/2021, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
DUE INVOICE.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DUE INVOICE.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target DUE INVOICE.exe
- Size 1.2MB
- Sample210505-89ylwd8cba
- SHA256 28b88aa9eb8a0c26b778b76cf91f5ad2b05c013fcbee258c5df0f9d23200bbf9
- MD5 e2c801b8df85d1dd8254b86ae2a61b6c
- SHA1 8c422abbefb516b0e4aac85fbc98e639904508fc
- SHA512 ce0e9336c7b65f919a48754e9e4638ea68ecf65dbbfe52ea31575da5d2dda60cefda5a42c702588e407dc3129154908cc846f17e321cef19e421f4753f6ea334
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk DUE INVOICE.exe - Loads dropped DLL 64 IoCs
pid Process 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe 1568 DUE INVOICE.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 108 set thread context of 1568 108 DUE INVOICE.exe 31 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vpack200.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe DUE INVOICE.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe DUE INVOICE.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjcmd.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vorbd.ico DUE INVOICE.exe File created C:\Program Files\7-Zip\v7zFM.ico DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjvisualvm.ico DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe DUE INVOICE.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjavadoc.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjavaw.ico DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe DUE INVOICE.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui DUE INVOICE.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjar.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB86F.tmp DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjstack.ico DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe DUE INVOICE.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe DUE INVOICE.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPSVC.EXE DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjava-rmi.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB95B.tmp DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe DUE INVOICE.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DUE INVOICE.exe File created C:\Program Files\7-Zip\v7zG.ico DUE INVOICE.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe DUE INVOICE.exe File created C:\Program Files\Java\jre7\bin\vjabswitch.ico DUE INVOICE.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\vchrome_pwa_launcher.exe DUE INVOICE.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjabswitch.ico DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjavaws.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe DUE INVOICE.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui DUE INVOICE.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE DUE INVOICE.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOXMLED.ico DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\vkinit.exe DUE INVOICE.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\vchrome_pwa_launcher.ico DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vklist.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\vjavaw.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjdb.ico DUE INVOICE.exe File created C:\Program Files\VideoLAN\VLC\vuninstall.ico DUE INVOICE.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjrunscript.ico DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe DUE INVOICE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe DUE INVOICE.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe DUE INVOICE.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe DUE INVOICE.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\bfsvc.exe DUE INVOICE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1228 schtasks.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 108 wrote to memory of 1228 108 DUE INVOICE.exe 29 PID 108 wrote to memory of 1228 108 DUE INVOICE.exe 29 PID 108 wrote to memory of 1228 108 DUE INVOICE.exe 29 PID 108 wrote to memory of 1228 108 DUE INVOICE.exe 29 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31 PID 108 wrote to memory of 1568 108 DUE INVOICE.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\DUE INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\DUE INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ubRWFYC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD01.tmp"2⤵
- Creates scheduled task(s)
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\DUE INVOICE.exe"{path}"2⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1568
-