5940bcba679b7641c6af570a067202cadbbc68fdc296121943f7b29507ac10ab

Analysis

Target

Invoice Payment Confirmation.exe
Size

1.1MB
MD5

b48ff2c42b9fd1a070a119a756c491df
SHA1

f2b27c9b37d0d4cba954f796f87a736e2d51ed32
SHA256

5940bcba679b7641c6af570a067202cadbbc68fdc296121943f7b29507ac10ab
SHA512

baf0bf247252370fef86038fb1b8d8f956be029e37b0b645f89fa3513685877e96857a2440e2e42a1aa8ff3e693b2fb6882a43bc7c37d999b06235e2e22c80f2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3416	Invoice Payment Confirmation.exe
3416	Invoice Payment Confirmation.exe
3416	Invoice Payment Confirmation.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4932	3416	Invoice Payment Confirmation.exe	82
PID 3416 wrote to memory of 4932	3416	Invoice Payment Confirmation.exe	82
PID 3416 wrote to memory of 4932	3416	Invoice Payment Confirmation.exe	82

C:\Users\Admin\AppData\Local\Temp\Invoice Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice Payment Confirmation.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact