8b0bc19da168e08d383523f412fd6dd81fecdfccdfe59d239c736506dc13b0cd

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2022, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT Original Invoice.exe
Size 335KB
Sample220813-g2ms1shad2
SHA256 8b0bc19da168e08d383523f412fd6dd81fecdfccdfe59d239c736506dc13b0cd
MD5 6b2728139698e9f8dd53d208982d0641
SHA1 5e6da39f8b722d4123bdfa07409c7fd78b3d5737
SHA512 791d38d8dda6a8929420dc37c3a00b020806123710d841e1cdc778e4be1bdfa17e303905e3f9099fc8adc0c2b8e61a6a03684dfa880d8b15f29f96a284190369
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3188	4720	TNT Original Invoice.exe	78
PID 3188 set thread context of 3052	3188	cvtres.exe	54
PID 1356 set thread context of 3052	1356	raserver.exe	54

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3188	cvtres.exe
3188	cvtres.exe
3188	cvtres.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe
1356	raserver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	cvtres.exe
Token: SeDebugPrivilege	1356	raserver.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 4720 wrote to memory of 3188	4720	TNT Original Invoice.exe	78
PID 3052 wrote to memory of 1356	3052	Explorer.EXE	79
PID 3052 wrote to memory of 1356	3052	Explorer.EXE	79
PID 3052 wrote to memory of 1356	3052	Explorer.EXE	79
PID 1356 wrote to memory of 4108	1356	raserver.exe	80
PID 1356 wrote to memory of 4108	1356	raserver.exe	80
PID 1356 wrote to memory of 4108	1356	raserver.exe	80

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-142-0x0000000000290000-0x00000000002AF000-memory.dmp

Download

memory/1356-147-0x00000000006F0000-0x000000000071B000-memory.dmp

Download

memory/1356-145-0x0000000002410000-0x000000000249F000-memory.dmp

Download

memory/1356-144-0x0000000002660000-0x00000000029AA000-memory.dmp

Download

memory/1356-143-0x00000000006F0000-0x000000000071B000-memory.dmp

Download

memory/3052-148-0x0000000008680000-0x0000000008744000-memory.dmp

Download

memory/3052-146-0x0000000008680000-0x0000000008744000-memory.dmp

Download

memory/3052-139-0x00000000035B0000-0x000000000366E000-memory.dmp

Download

memory/3188-138-0x0000000001360000-0x0000000001370000-memory.dmp

Download

memory/3188-141-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3188-137-0x000000000041F000-0x0000000000421000-memory.dmp

Download

memory/3188-136-0x0000000001900000-0x0000000001C4A000-memory.dmp

Download

memory/3188-134-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4720-132-0x00000000000C0000-0x0000000000116000-memory.dmp

Download