3c899c73d5ea50974caaecffad5ff67922cfea4d233ac0f4a0b24814bdb76ab8 | Triage

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 19:05

Sharing

Report Analysis Logs

General

Target

invoice.exe
Size

16KB
MD5

aa1d9a07e0bd53a161cb35168bb1bb31
SHA1

f4503fd5b9d8b23c02bff1abd23fb17ce341f907
SHA256

08ad11bae99deab8e128dfea4c85f8bb46124f32a7cfae956c1b650e94f005fa
SHA512

1185abec300c865b7f167f583b5b2ea62b7860ad9da58d0b0779a754ea9fc783a8c49d6592e345c7840ad773936a14d9ced6e39651eeaecf3271d5acd9b36049

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/64-134-0x0000000000870000-0x0000000000C54000-memory.dmp	upx
behavioral2/memory/64-135-0x0000000000870000-0x0000000000C54000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 3792 set thread context of 64 3792 invoice.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5012 64 WerFault.exe svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

invoice.exe

description pid process

Token: SeDebugPrivilege 3792 invoice.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe
PID 3792 wrote to memory of 64	3792	invoice.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 192
3⤵
- Program crash
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 64
1⤵
PID:392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-132-0x0000000000000000-mapping.dmp

Download
memory/64-134-0x0000000000870000-0x0000000000C54000-memory.dmp

Filesize
3.9MB

Download
memory/64-135-0x0000000000870000-0x0000000000C54000-memory.dmp

Filesize
3.9MB

Download
memory/3792-130-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/3792-131-0x0000000004D00000-0x0000000004D9C000-memory.dmp

Filesize
624KB

Download