Analysis
-
max time kernel
111s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:18
Static task
static1
Behavioral task
behavioral1
Sample
Invoices.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Invoices.scr
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Payment Copy.scr
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Payment Copy.scr
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Pictures.scr
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Pictures.scr
Resource
win10v2004-20220414-en
General
-
Target
Invoices.scr
-
Size
642KB
-
MD5
7e1276e8a9605cceaeb2c92ee2dee098
-
SHA1
d2ff633768b6745d8e8f171d84c3aba4c2f1b92d
-
SHA256
e61b98aab63f89f2c11d138da7c42c20e5f5019a6063e4af547c7f2903cd133c
-
SHA512
ec534ea78f14507e2984e5a80a5d8cdeddfb99f96dd7c85f5ce3ad5269455fd1919cf60a922fc42610c716461ac46b8edaf364c0aa66d061305f26902fe46901
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
z123456789ok
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
z123456789ok
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4036-134-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Invoices.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Invoices.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Invoices.scr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Invoices.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Invoices.scr -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Invoices.scrdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Invoices.scr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Invoices.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoices.scrdescription pid process target process PID 2108 set thread context of 4036 2108 Invoices.scr MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Invoices.scrMSBuild.exepid process 2108 Invoices.scr 4036 MSBuild.exe 4036 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Invoices.scrMSBuild.exedescription pid process Token: SeDebugPrivilege 2108 Invoices.scr Token: SeDebugPrivilege 4036 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 4036 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Invoices.scrdescription pid process target process PID 2108 wrote to memory of 4924 2108 Invoices.scr schtasks.exe PID 2108 wrote to memory of 4924 2108 Invoices.scr schtasks.exe PID 2108 wrote to memory of 4924 2108 Invoices.scr schtasks.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe PID 2108 wrote to memory of 4036 2108 Invoices.scr MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoices.scr"C:\Users\Admin\AppData\Local\Temp\Invoices.scr" /S1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZDNxwnC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8146.tmp"2⤵
- Creates scheduled task(s)
PID:4924 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8146.tmpFilesize
1KB
MD57dac9f1fce63bae14ff1a84ac2757faf
SHA152377485ca22ba1cbba024a22bfb7d92af0bd5cb
SHA256565b08aed8642c0696141adff8e7a3566a42947e57ac59cd93f6912655a98817
SHA512fbe7e3d851cd348888c3f9ee9f0b8d933811a33c142e97f10d5713e1afa390a702ec8ff9054696f06c0d109c5fe744c331afac1dab8bc07afd7c0cca4d198a13
-
memory/2108-130-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4036-133-0x0000000000000000-mapping.dmp
-
memory/4036-134-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4036-135-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4924-131-0x0000000000000000-mapping.dmp