6ecc41234c9c627fb864d3de10169477884aab6d62c199141a1b1b2da8b7ff8c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2022, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT_e-invoice_N0.11073490.exe
Size 574KB
Sample220722-mas4lsedd4
SHA256 6ecc41234c9c627fb864d3de10169477884aab6d62c199141a1b1b2da8b7ff8c
MD5 bb3516968514714ca4ecad0d4c2489a5
SHA1 341da4ceb8b935bf2beb60a21f61f4dae997d2f1
SHA512 c94a77059c5a7c35023575138a8d9bb243f9be94d161d14fd0fa5d92b7bb0c83bbae2396c59b576c877a46bd365933bfe5f7cb6bf5962d51592a012aad493ee8
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Blocklisted process makes network request 5 IoCs

flow	pid	Process
30	4180	cmd.exe
31	4180	cmd.exe
32	4180	cmd.exe
34	4180	cmd.exe
36	4180	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	TNT_e-invoice_N0.11073490.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 4768 set thread context of 2616	4768	TNT_e-invoice_N0.11073490.exe	54
PID 4180 set thread context of 2616	4180	cmd.exe	54

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe
4180	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4768	TNT_e-invoice_N0.11073490.exe
4180	cmd.exe
4180	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	TNT_e-invoice_N0.11073490.exe
Token: SeDebugPrivilege	4180	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2060 wrote to memory of 4768	2060	TNT_e-invoice_N0.11073490.exe	78
PID 2616 wrote to memory of 4180	2616	Explorer.EXE	79
PID 2616 wrote to memory of 4180	2616	Explorer.EXE	79
PID 2616 wrote to memory of 4180	2616	Explorer.EXE	79

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe
  "C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe
    "C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-131-0x00000000052E0000-0x0000000005884000-memory.dmp

Download

memory/2060-132-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Download

memory/2060-133-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Download

memory/2060-134-0x0000000005210000-0x00000000052AC000-memory.dmp

Download

memory/2060-130-0x0000000000300000-0x0000000000396000-memory.dmp

Download

memory/2616-141-0x00000000028A0000-0x00000000029B2000-memory.dmp

Download

memory/2616-149-0x0000000008150000-0x000000000824C000-memory.dmp

Download

memory/2616-147-0x0000000008150000-0x000000000824C000-memory.dmp

Download

memory/4180-143-0x0000000000A00000-0x0000000000A5A000-memory.dmp

Download

memory/4180-144-0x0000000001030000-0x000000000105D000-memory.dmp

Download

memory/4180-145-0x0000000001910000-0x0000000001C5A000-memory.dmp

Download

memory/4180-146-0x00000000017A0000-0x0000000001830000-memory.dmp

Download

memory/4180-148-0x0000000001030000-0x000000000105D000-memory.dmp

Download

memory/4768-139-0x0000000001110000-0x000000000145A000-memory.dmp

Download

memory/4768-140-0x0000000000FD0000-0x0000000000FE1000-memory.dmp

Download

memory/4768-138-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4768-136-0x0000000000400000-0x000000000042D000-memory.dmp

Download