Analysis
-
max time kernel
125s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08/02/2022, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
Invoice Confirmation.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
Invoice Confirmation.exe
-
Size
532KB
-
MD5
ddba3b95498cd1cb484ac05fcc362309
-
SHA1
25589926b5c189b8bee1c942839993c966c2a48a
-
SHA256
6d1939969f1763fa1f69073ed09fa37d443fd3a6739584bf5943ca8e54963023
-
SHA512
01db638e872d7f257a30586f989802e1d17f0c5aea06ac6d19939fef2e507e7bcd2e7fa07589d39f3e2a166ed1a900d4869be86a876c58dcf3f34c5efdd53cae
Malware Config
Signatures
-
Kutaki Executable 3 IoCs
resource yara_rule behavioral1/files/0x0007000000012665-58.dat family_kutaki behavioral1/files/0x0007000000012665-59.dat family_kutaki behavioral1/files/0x0007000000012665-60.dat family_kutaki -
Executes dropped EXE 1 IoCs
pid Process 924 bvrnpkch.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bvrnpkch.exe Invoice Confirmation.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bvrnpkch.exe Invoice Confirmation.exe -
Loads dropped DLL 2 IoCs
pid Process 1692 Invoice Confirmation.exe 1692 Invoice Confirmation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1140 DllHost.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1692 Invoice Confirmation.exe 1692 Invoice Confirmation.exe 1692 Invoice Confirmation.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe 924 bvrnpkch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1692 wrote to memory of 484 1692 Invoice Confirmation.exe 28 PID 1692 wrote to memory of 484 1692 Invoice Confirmation.exe 28 PID 1692 wrote to memory of 484 1692 Invoice Confirmation.exe 28 PID 1692 wrote to memory of 484 1692 Invoice Confirmation.exe 28 PID 1692 wrote to memory of 924 1692 Invoice Confirmation.exe 30 PID 1692 wrote to memory of 924 1692 Invoice Confirmation.exe 30 PID 1692 wrote to memory of 924 1692 Invoice Confirmation.exe 30 PID 1692 wrote to memory of 924 1692 Invoice Confirmation.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\Receipt.bmp2⤵PID:484
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bvrnpkch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bvrnpkch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1140