Analysis
-
max time kernel
129s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:18
Static task
static1
Behavioral task
behavioral1
Sample
Invoices.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Invoices.scr
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Payment Copy.scr
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Payment Copy.scr
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Pictures.scr
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Pictures.scr
Resource
win10v2004-20220414-en
General
-
Target
Invoices.scr
-
Size
642KB
-
MD5
7e1276e8a9605cceaeb2c92ee2dee098
-
SHA1
d2ff633768b6745d8e8f171d84c3aba4c2f1b92d
-
SHA256
e61b98aab63f89f2c11d138da7c42c20e5f5019a6063e4af547c7f2903cd133c
-
SHA512
ec534ea78f14507e2984e5a80a5d8cdeddfb99f96dd7c85f5ce3ad5269455fd1919cf60a922fc42610c716461ac46b8edaf364c0aa66d061305f26902fe46901
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
z123456789ok
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-61-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1176-62-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1176-63-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1176-64-0x000000000045449E-mapping.dmp family_agenttesla behavioral1/memory/1176-66-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1176-68-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Invoices.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Invoices.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Invoices.scr -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Invoices.scrdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Invoices.scr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Invoices.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoices.scrdescription pid process target process PID 732 set thread context of 1176 732 Invoices.scr MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Invoices.scrMSBuild.exepid process 732 Invoices.scr 1176 MSBuild.exe 1176 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Invoices.scrMSBuild.exedescription pid process Token: SeDebugPrivilege 732 Invoices.scr Token: SeDebugPrivilege 1176 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1176 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Invoices.scrdescription pid process target process PID 732 wrote to memory of 900 732 Invoices.scr schtasks.exe PID 732 wrote to memory of 900 732 Invoices.scr schtasks.exe PID 732 wrote to memory of 900 732 Invoices.scr schtasks.exe PID 732 wrote to memory of 900 732 Invoices.scr schtasks.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe PID 732 wrote to memory of 1176 732 Invoices.scr MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoices.scr"C:\Users\Admin\AppData\Local\Temp\Invoices.scr" /S1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZDNxwnC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF5F.tmp"2⤵
- Creates scheduled task(s)
PID:900 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEF5F.tmpFilesize
1KB
MD52a1de7745e93b19d3b439bce7deb8dd2
SHA12ed65149fb0e866465219734279407f822b1cd56
SHA2564d66fabb5951bedbe4f7b6ee0efc11ee682f3d8b01006f28c3cc47ea90684fe4
SHA5124b6e6cfba410056d60d159ca646a884adf10aab498a873e1b86dce33e3d3a5ebce32c7e0dc28eb2c4fe37bff2aad539d8d9ab71b927ad22bc4c6f702d49face5
-
memory/732-54-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/732-55-0x0000000074BD0000-0x000000007517B000-memory.dmpFilesize
5.7MB
-
memory/900-56-0x0000000000000000-mapping.dmp
-
memory/1176-61-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-59-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-58-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-62-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-63-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-64-0x000000000045449E-mapping.dmp
-
memory/1176-66-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-68-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1176-70-0x0000000074BD0000-0x000000007517B000-memory.dmpFilesize
5.7MB