4757d64431cbf911d9a6cc5b1cd96ee7f733dd0eb05c41f1fa100ba3d354d4a5

General

Target

proforma invoice.exe
Size

529KB
MD5

f037acb1b049f26a865e27398d12bc38
SHA1

49dc65e895ca6553c8ac6f98adae426582d18d52
SHA256

4757d64431cbf911d9a6cc5b1cd96ee7f733dd0eb05c41f1fa100ba3d354d4a5
SHA512

ad5c6d9640505b12f3c1220eeca91f71a9d22220064eee018f8502a223e7e0c6c428b8996a9514a6cef9895a912054f83765f4a974867c59dc91156059335cbf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

proforma invoice.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pxpjdzm = "C:\\Users\\Public\\Libraries\\mzdjpxP.url"	proforma invoice.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1112 WerFault.exe dialer.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1628 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1628 WerFault.exe

pid	pid_target	process	target process
1628	1112	WerFault.exe	dialer.exe

pid	process
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe

pid	process
1628	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1628	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

proforma invoice.exedialer.exe

description	pid	process	target process
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 2004 wrote to memory of 1112	2004	proforma invoice.exe	dialer.exe
PID 1112 wrote to memory of 1628	1112	dialer.exe	WerFault.exe
PID 1112 wrote to memory of 1628	1112	dialer.exe	WerFault.exe
PID 1112 wrote to memory of 1628	1112	dialer.exe	WerFault.exe
PID 1112 wrote to memory of 1628	1112	dialer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 156
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-65-0x0000000000000000-mapping.dmp

Download
memory/1112-67-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1112-68-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1112-71-0x0000000010670000-0x00000000107C6000-memory.dmp

Filesize
1.3MB

Download
memory/1112-72-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1628-69-0x0000000000000000-mapping.dmp

Download
memory/1628-73-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2004-60-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/2004-61-0x00000000001D0000-0x00000000001EA000-memory.dmp

Filesize
104KB

Download
memory/2004-64-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing