Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 17:11
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7-20220414-en
General
-
Target
Invoice.exe
-
Size
863KB
-
MD5
c2720ce6cc0f31551a6cef74c8dfc79e
-
SHA1
d12f85204042be1a50dc6d876dfd603a00baf0bc
-
SHA256
52fe19cf1fd62bf14e93b6047ab9a4caa7d4874b0775b2b999829476ccfaacef
-
SHA512
b15474ba548d4c1e180590291f45a7bc73832ebb392a3a837b32df0acf008e093cb9dc62fea3912c1d25d9c8460015cbd1379370ed34cd84d1f4e7d21bb167bd
Malware Config
Extracted
nanocore
1.2.2.0
172.94.42.77:54983
fa062181-d17f-4771-b853-56ad4122293b
-
activate_away_mode
true
-
backup_connection_host
172.94.42.77
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-16T19:45:17.991100336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54983
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fa062181-d17f-4771-b853-56ad4122293b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
172.94.42.77
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Invoice.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe" Invoice.exe -
Processes:
Invoice.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Invoice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoice.exedescription pid process target process PID 2824 set thread context of 2236 2824 Invoice.exe Invoice.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Invoice.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsvc.exe Invoice.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsvc.exe Invoice.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Invoice.exeInvoice.exepid process 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe 2236 Invoice.exe 2236 Invoice.exe 2236 Invoice.exe 2824 Invoice.exe 2824 Invoice.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Invoice.exepid process 2236 Invoice.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Invoice.exeInvoice.exedescription pid process Token: SeDebugPrivilege 2824 Invoice.exe Token: SeDebugPrivilege 2236 Invoice.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Invoice.exedescription pid process target process PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe PID 2824 wrote to memory of 2236 2824 Invoice.exe Invoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-135-0x0000000000000000-mapping.dmp
-
memory/2236-136-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2824-130-0x0000000000A70000-0x0000000000B4C000-memory.dmpFilesize
880KB
-
memory/2824-131-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/2824-132-0x0000000005400000-0x0000000005492000-memory.dmpFilesize
584KB
-
memory/2824-133-0x00000000053B0000-0x00000000053BA000-memory.dmpFilesize
40KB
-
memory/2824-134-0x0000000005660000-0x00000000056FC000-memory.dmpFilesize
624KB