4757d64431cbf911d9a6cc5b1cd96ee7f733dd0eb05c41f1fa100ba3d354d4a5

General

Target

proforma invoice.exe
Size

529KB
MD5

f037acb1b049f26a865e27398d12bc38
SHA1

49dc65e895ca6553c8ac6f98adae426582d18d52
SHA256

4757d64431cbf911d9a6cc5b1cd96ee7f733dd0eb05c41f1fa100ba3d354d4a5
SHA512

ad5c6d9640505b12f3c1220eeca91f71a9d22220064eee018f8502a223e7e0c6c428b8996a9514a6cef9895a912054f83765f4a974867c59dc91156059335cbf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

proforma invoice.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pxpjdzm = "C:\\Users\\Public\\Libraries\\mzdjpxP.url"	proforma invoice.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1908 1760 WerFault.exe secinit.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1908 WerFault.exe
1908 WerFault.exe
1908 WerFault.exe
1908 WerFault.exe
1908 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1908 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1908 WerFault.exe

pid	pid_target	process	target process
1908	1760	WerFault.exe	secinit.exe

pid	process
1908	WerFault.exe
1908	WerFault.exe
1908	WerFault.exe
1908	WerFault.exe
1908	WerFault.exe

pid	process
1908	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1908	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

proforma invoice.exesecinit.exe

description	pid	process	target process
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1876 wrote to memory of 1760	1876	proforma invoice.exe	secinit.exe
PID 1760 wrote to memory of 1908	1760	secinit.exe	WerFault.exe
PID 1760 wrote to memory of 1908	1760	secinit.exe	WerFault.exe
PID 1760 wrote to memory of 1908	1760	secinit.exe	WerFault.exe
PID 1760 wrote to memory of 1908	1760	secinit.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\secinit.exe
C:\Windows\System32\secinit.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 180
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-65-0x0000000000000000-mapping.dmp

Download
memory/1760-70-0x0000000010670000-0x00000000107C6000-memory.dmp

Filesize
1.3MB

Download
memory/1760-69-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1760-68-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1760-71-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1876-60-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1876-61-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/1876-64-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1908-67-0x0000000000000000-mapping.dmp

Download
memory/1908-73-0x0000000000270000-0x00000000002D0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing