e94a1d46afd9738b1f200ff2d221c74d236dcbf954383466dbe95ba3c4f6100d

General

Target

invoice00232________________________________________________________________________________________.exe
Size

16KB
MD5

6ba67836488da9a76d8f7c67d3576f71
SHA1

169c3232cbbe5fee27ce6b1e26706ce6dc7dc350
SHA256

1a9ea07853428a1bab8418690e5cf45044f16657f5f7ab7ff8dbd0c6f13fac92
SHA512

6ff0a168ac8e8e399af447b09a2e600521f84e7a5579d51abe47241a0fe96801f47edd6a6b2138428e1bbac4e46fc29f49a25712eb0a6ab2e260cdabe5cb4c03
SSDEEP

384:U2iTgTYyU/m1V0U+awNWaNLXJS1zqa0FMbRvWG6L6:UZTgTYyoaV0U9e542TM1+G26

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	invoice00232________________________________________________________________________________________.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SISuXKF = "C:\\Users\\Admin\\AppData\\Roaming\\SISuXKF\\SISuXKF.exe"	invoice00232________________________________________________________________________________________.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 4024	5044	invoice00232________________________________________________________________________________________.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe
5044	invoice00232________________________________________________________________________________________.exe
4024	invoice00232________________________________________________________________________________________.exe
4024	invoice00232________________________________________________________________________________________.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	invoice00232________________________________________________________________________________________.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4024	invoice00232________________________________________________________________________________________.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4024	invoice00232________________________________________________________________________________________.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4744	5044	invoice00232________________________________________________________________________________________.exe	80
PID 5044 wrote to memory of 4744	5044	invoice00232________________________________________________________________________________________.exe	80
PID 5044 wrote to memory of 4744	5044	invoice00232________________________________________________________________________________________.exe	80
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83
PID 5044 wrote to memory of 4024	5044	invoice00232________________________________________________________________________________________.exe	83

C:\Users\Admin\AppData\Local\Temp\invoice00232________________________________________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\invoice00232________________________________________________________________________________________.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\invoice00232________________________________________________________________________________________.exe
  C:\Users\Admin\AppData\Local\Temp\invoice00232________________________________________________________________________________________.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice00232________________________________________________________________________________________.exe.log

Filesize
1KB

MD5
ef95a426c7cadbe261c528f59813e6ab

SHA1
5edc710e2a90db2d262dd4d10d6f09d20e823007

SHA256
b481e9bf0515a6beb15cb252f60847275d978eba72691d5d8fa1c6a79b5cda9a

SHA512
53039306141608f7a606a1500f61193be16e97e53724b0d76721106c8dc7a5a8406c96019b9c32d0800d011bd2e55f46d34d2d74ed9b2661c7e006e329c45180

Download Submit
memory/4024-148-0x0000000006C90000-0x0000000006C9A000-memory.dmp

Filesize
40KB

Download
memory/4024-147-0x0000000005870000-0x000000000590C000-memory.dmp

Filesize
624KB

Download
memory/4024-145-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4744-136-0x0000000005B00000-0x0000000006128000-memory.dmp

Filesize
6.2MB

Download
memory/4744-138-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/4744-139-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/4744-140-0x0000000007EB0000-0x000000000852A000-memory.dmp

Filesize
6.5MB

Download
memory/4744-141-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Filesize
104KB

Download
memory/4744-137-0x00000000061A0000-0x0000000006206000-memory.dmp

Filesize
408KB

Download
memory/4744-135-0x0000000003280000-0x00000000032B6000-memory.dmp

Filesize
216KB

Download
memory/5044-142-0x0000000008E60000-0x0000000008EF2000-memory.dmp

Filesize
584KB

Download
memory/5044-143-0x00000000099F0000-0x0000000009F94000-memory.dmp

Filesize
5.6MB

Download
memory/5044-132-0x0000000000050000-0x000000000005A000-memory.dmp

Filesize
40KB

Download
memory/5044-133-0x00000000088E0000-0x0000000008902000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing