Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.cab
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.cab
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe
Resource
win7-20220812-en
General
-
Target
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe
-
Size
277KB
-
MD5
adfbf0d0858c2ccf0c3070967f1c5a3e
-
SHA1
e723c9f072504c3345f91829000ec7d96ac6661a
-
SHA256
54d71b452ceceb7769f2ab610d157005849ec32aae5544acaa99d08f8d12cd95
-
SHA512
7c08f20307f27a8f91fdf53efd1280b898e78fbc8382c4b3dd3fc3f7f75204e0c4fafb5e7bc97d53872d46fc3ab72851703c8f0d6e932c407d3b5e6e68f07749
-
SSDEEP
6144:KAJjLwdO06a3KpeQnaMDCbd9D+E2fCos4OianeAsIJ/8kAG:KjO06IKpRnacCxx+EcCBnbX8kL
Malware Config
Extracted
formbook
f4ca
QYZ6iE9Y+CsiZpCBareS0uU=
N2FQLAaH6xXE
Vc6t0MQXN+Llxsqg
ElBedmSvYGGm6yLDhHqzAtmlCxWl
4VpIWShqHR5cpjfQ4bs=
mepO9miu/iFiQQ==
Z8Owqh54IlwEpDfQ4bs=
qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo
IaYYoJikKDDqgV/NigZCLA==
4Xz5pfoCCW/76NnOUrFEOw==
xiijSkVJ3Yuh9OKDcmui/d2lCxWl
cr8MmfpCEu0ULsO3p6w=
JLm2yKHo7hdVb8O3p6w=
Hriy5svWm2Qfq9mPQib9jJI65gOr
2G3nkRpidunlxsqg
gPHUAeXmi8Q9ARy3
6l5WaOf8BxhQDkp5gKQ=
KHHiXs4WOqXZdPhpaw==
+UQ5Vz5O0Ms9ARy3
pNQygKu0OziAvjOHRGLnJA==
M5qPrHO70XILJV/OigZCLA==
Bwz2AdUUvLPoNoBcySTO
KJjsht/Of6qQeYo=
9RZ4FHl1i9tjjLtcaQ==
IHbpfXRupy3AuY53YbeS0uU=
b6mkuLnwenslCkJjG1iATee5mGNJZA==
8zSsXODtGdFshtAAq8/84qAdyWHlSRb8OA==
1mO8Rr4ZsdaKHyjIigZCLA==
/ui43zLv/iFiQQ==
awBv/mmr/iFiQQ==
FzPXOR1MP6LCeacQ230v4cZCSg==
71peZiwr4LDIKTXLigZCLA==
skAiLfTuomFyKFjKigZCLA==
MWxMWMDIzlv8FmCRTC1sEK8smGNJZA==
bdIXrhYkUpPgGFTGigZCLA==
KVi0U6AAgX0bm69LRH+44WFEXQ==
+D5ILQaH6xXE
KXNjcguH6xXE
uUw4NsLMwznO8DCok5284WFEXQ==
bpTmlRJhlBtTIWXQigZCLA==
hgLX9+LVB44xMU7MigZCLA==
9eIK+99sbak=
wEQyQx5W7vq2QGYf2SZtRqSoV+8=
ofjaCQZVBhGwWZd9YbeS0uU=
suPZ6swTIqqQeYo=
U+ZbBWlkdr7vEzXhm/mwHhbKuJ19fA==
1l/oh36HBv2RMXxcySTO
d5wkrq+mz3ZP/1W/
y+Za+XOo1HklJE/6tbU=
MrobxTxIXZ0lwwDx8DuhOB2u
h6nQ6B9ca6o=
niYQHxujFCDG
ITyqOJbtbWmceMO3p6w=
exCIJzB+kFbIzsq9Yw==
R8BN7ertksNfB0c2MGKdjFrtlax0SRb8OA==
ygaUPcYVRNRoV0lrZaunAPI=
u+BS4kyibTLlxsqg
FX5XcVKp1I9JHmyinq4=
1AABJPxNW5kknYkiGzgpWCrE2uc=
e7KTvkWOes4AQHtcySTO
Y8uNpo+SKOIIwvSkOLeS0uU=
wvFsBI3N3VmiZpqxcLeS0uU=
o0s+RSt6lUPH8xcD+W3AEgKm
XCJ0FKy6zloOGiRYXbeS0uU=
mettafizzix.org
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
cmmon32.exepid process 1284 cmmon32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.execvtres.execmmon32.exedescription pid process target process PID 1808 set thread context of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 952 set thread context of 1216 952 cvtres.exe Explorer.EXE PID 952 set thread context of 1216 952 cvtres.exe Explorer.EXE PID 1284 set thread context of 1216 1284 cmmon32.exe Explorer.EXE -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
cvtres.execmmon32.exepid process 952 cvtres.exe 952 cvtres.exe 952 cvtres.exe 952 cvtres.exe 952 cvtres.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
cvtres.execmmon32.exepid process 952 cvtres.exe 952 cvtres.exe 952 cvtres.exe 952 cvtres.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe 1284 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.execmmon32.exedescription pid process Token: SeDebugPrivilege 952 cvtres.exe Token: SeDebugPrivilege 1284 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1808 wrote to memory of 952 1808 Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe cvtres.exe PID 1216 wrote to memory of 1284 1216 Explorer.EXE cmmon32.exe PID 1216 wrote to memory of 1284 1216 Explorer.EXE cmmon32.exe PID 1216 wrote to memory of 1284 1216 Explorer.EXE cmmon32.exe PID 1216 wrote to memory of 1284 1216 Explorer.EXE cmmon32.exe PID 1284 wrote to memory of 472 1284 cmmon32.exe Firefox.exe PID 1284 wrote to memory of 472 1284 cmmon32.exe Firefox.exe PID 1284 wrote to memory of 472 1284 cmmon32.exe Firefox.exe PID 1284 wrote to memory of 472 1284 cmmon32.exe Firefox.exe PID 1284 wrote to memory of 472 1284 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe"C:\Users\Admin\AppData\Local\Temp\Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
890KB
MD58402a6aa76d7787ff03943dd129e3d83
SHA1895338cb761d62930ca93918011fd2cd33d5b30c
SHA25649ff99d5b24f4f7d5a8ea175f35a6548c74b04e5c621c60121b5088dab19b4eb
SHA51239bbe90385be35492825929296aae771fb4afb00a1f6a48f0e4ec17bc1097c3a32cea3b22033116c82695e66acbd6c847483a8da21e7302240467b58e39169ea
-
memory/952-61-0x00000000004012B0-mapping.dmp
-
memory/952-74-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/952-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-70-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/952-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-65-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/952-66-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/952-67-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/952-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1216-68-0x0000000004FB0000-0x000000000512C000-memory.dmpFilesize
1.5MB
-
memory/1216-79-0x0000000004920000-0x00000000049FD000-memory.dmpFilesize
884KB
-
memory/1216-82-0x0000000004920000-0x00000000049FD000-memory.dmpFilesize
884KB
-
memory/1216-71-0x0000000006800000-0x000000000690A000-memory.dmpFilesize
1.0MB
-
memory/1284-80-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1284-75-0x0000000000B00000-0x0000000000B0D000-memory.dmpFilesize
52KB
-
memory/1284-76-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1284-77-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/1284-78-0x00000000008D0000-0x000000000095F000-memory.dmpFilesize
572KB
-
memory/1284-81-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1284-72-0x0000000000000000-mapping.dmp
-
memory/1808-56-0x0000000000390000-0x0000000000398000-memory.dmpFilesize
32KB
-
memory/1808-54-0x00000000013D0000-0x000000000141A000-memory.dmpFilesize
296KB
-
memory/1808-55-0x0000000000380000-0x000000000038C000-memory.dmpFilesize
48KB