Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE 103321.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PROFORMA INVOICE 103321.rar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
PROFORMA INVOICE 103321.exe
Resource
win7-20220901-en
General
-
Target
PROFORMA INVOICE 103321.exe
-
Size
916KB
-
MD5
6b34c7d21457240410f7526870fb3cc8
-
SHA1
ad4f885afeefe8d5c06f8ed14736705fb0b527f1
-
SHA256
4e299e221bff547ce81f39f447b914d120e8411bd4d38a5cf7014e5241e757ad
-
SHA512
1a8a7160adf1acea7cd76a7b739129f95afe931d9e5544d874e20d7f9c330c297618cb1f7cb69ced06fa22aaf95ef68dbf1df1e6898143061c8c360b3b48b61e
-
SSDEEP
12288:2ZMBqPwNK7sb7/sn1gSp4JZjAH1wBjGrCwDBo6RU2snF90NcZnbhR9jqI:he7w7En1gSp4TjQw5+CCrKFSNYbX9jn
Malware Config
Extracted
formbook
d8ax
wQDD4HkJc+vErnk=
j7vdn039QTY5Gcs43SDb8R4gwLgFCI7s
ZqPN0enMl4As
kKK00fOMq6KZmHv6kZjEiTm3l1o=
CxCTti/0Dcs5qly/AVHoTg==
5TwVtD3wcevErnk=
/ieoWNXMl4As
caK67QvHGhmiEuKpidX2RA==
Bbyy3J6D1Qw=
LV5N2gOocvpbA/OB/w==
k7k2OMNsBY67libDOi4=
wuDokhS1jLo4mA==
RVGz6anMl4As
la40BCHFwoI/rpugbdoaWQ==
XmVnfY0nNACG5si5u8Ds6F79xw==
dpyQTuytl0/bShsFIYUaHRzIL4quYwxgTA==
yvmesDDPpTSrLhf5GlvvdaCZekhAsg==
obTEXhervaSWkSbDOi4=
ClZogXcOT1DcPyvgOKJM
Drlokv/cjLo4mA==
V4oZcMaLgjLLXfXt+g==
8BRWc4dCh+vErnk=
gZs1StGIWxHCXfXt+g==
kNWGiRXrqi1iPQlc/GU8hYQ=
nJQn54uLlWECXfXt+g==
2AU1AaNCuTog/+7M7vL++nxyjAYhug==
gLTciPW1cBLCXfXt+g==
7h7ZsWhwmJQ9Yhfd
NlFTcDIRY5WSlA==
KVxtg4EkZ5y2mybDOi4=
vc7dlj8GnRU5KNelbdoaWQ==
+hol4ZAxhsDDnSbDOi4=
0tlf7fGn6GENckSlV1dqs5o=
FVb6DpNaVBG+XfXt+g==
UNsBOPIUJJ8ud24=
1SbXAalJ3GCPfjtUDDXEVg==
OV4aRNJh6jVcNvy/xcS5Kjxc
hZqaRL5W4UlWPx16GpE2ySHpekhAsg==
QmTiBn1ALazBlibDOi4=
9jToDI8w5WJ7WCyhMmU8hYQ=
ECSrOEcC+aAef2VeVSE/tjm3l1o=
0tp9JDPs5pgphEIP41zldsC8zw==
HD7IzWMMmQt4I9wzbdoaWQ==
cKdMehnTerbJqCbDOi4=
RWhnXi5ZIGqjgmQ=
0fRlIEMHSE49Yhfd
bqrQ+DHBm4g1rJSRvsLs6F79xw==
rOoQJyHHH1VnPv1O1QiiuwbYnW74
g4SVt952e2RtcD6fKWU8hYQ=
R1huOuCLWV+pfwLgOKJM
pChMES6ijLo4mA==
9yWJOJyjtdIgzoTTZrq4iDm3l1o=
utfRc/OFAD4wFdk3bdoaWQ==
fpIYx++FK5+9spOpmf8YTg==
Jt0GgpzIjLo4mA==
srzO4u1vfXUKglbgOKJM
oK5G2NiBmWz7VRH241zldsC8zw==
LzzMZHMwGtevgmQ=
DFPw/EEd4Yc9Yhfd
cL7kACe5n07ZcfTD4w==
g8QFmC3VK2KCt0mmKyw=
mtl0BPzHDEsEWf1g3yC7UQ==
bZ/RdPiCxerz56ebbdoaWQ==
ZYALGqMrqw6bCd83bdoaWQ==
linktau-roads.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PROFORMA INVOICE 103321.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation PROFORMA INVOICE 103321.exe -
Loads dropped DLL 1 IoCs
Processes:
NETSTAT.EXEpid process 1716 NETSTAT.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PROFORMA INVOICE 103321.exePROFORMA INVOICE 103321.exeNETSTAT.EXEdescription pid process target process PID 1600 set thread context of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 952 set thread context of 1232 952 PROFORMA INVOICE 103321.exe Explorer.EXE PID 1716 set thread context of 1232 1716 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1716 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
PROFORMA INVOICE 103321.exeNETSTAT.EXEpid process 952 PROFORMA INVOICE 103321.exe 952 PROFORMA INVOICE 103321.exe 952 PROFORMA INVOICE 103321.exe 952 PROFORMA INVOICE 103321.exe 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PROFORMA INVOICE 103321.exeNETSTAT.EXEpid process 952 PROFORMA INVOICE 103321.exe 952 PROFORMA INVOICE 103321.exe 952 PROFORMA INVOICE 103321.exe 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE 1716 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PROFORMA INVOICE 103321.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 952 PROFORMA INVOICE 103321.exe Token: SeDebugPrivilege 1716 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
PROFORMA INVOICE 103321.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1600 wrote to memory of 952 1600 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 1232 wrote to memory of 1716 1232 Explorer.EXE NETSTAT.EXE PID 1232 wrote to memory of 1716 1232 Explorer.EXE NETSTAT.EXE PID 1232 wrote to memory of 1716 1232 Explorer.EXE NETSTAT.EXE PID 1232 wrote to memory of 1716 1232 Explorer.EXE NETSTAT.EXE PID 1716 wrote to memory of 616 1716 NETSTAT.EXE Firefox.exe PID 1716 wrote to memory of 616 1716 NETSTAT.EXE Firefox.exe PID 1716 wrote to memory of 616 1716 NETSTAT.EXE Firefox.exe PID 1716 wrote to memory of 616 1716 NETSTAT.EXE Firefox.exe PID 1716 wrote to memory of 616 1716 NETSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
927KB
MD57fd80b1cc72dc580c02ca4cfbfb2592d
SHA118da905af878b27151b359cf1a7d0a650764e8a1
SHA2561e6dccbdf8527abb53c289da920463b7895300d0d984cc7e91a3ecda4e673190
SHA51213f7f29b5ed31c551aa5f27742557aa4d026a226087d6fcbca094819759ecc753a2c33b7422ae88dc6a4a0a966edb8485a18e59a0283ba2686cae5d78e0190a3
-
memory/952-68-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/952-64-0x00000000004012B0-mapping.dmp
-
memory/952-69-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/952-70-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/952-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/952-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/952-71-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/952-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/952-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/952-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1232-81-0x0000000006510000-0x00000000065E7000-memory.dmpFilesize
860KB
-
memory/1232-78-0x0000000006510000-0x00000000065E7000-memory.dmpFilesize
860KB
-
memory/1232-72-0x0000000002970000-0x0000000002A56000-memory.dmpFilesize
920KB
-
memory/1600-59-0x00000000047E0000-0x0000000004814000-memory.dmpFilesize
208KB
-
memory/1600-56-0x00000000005C0000-0x00000000005D6000-memory.dmpFilesize
88KB
-
memory/1600-57-0x0000000000780000-0x000000000078E000-memory.dmpFilesize
56KB
-
memory/1600-54-0x00000000008D0000-0x00000000009BA000-memory.dmpFilesize
936KB
-
memory/1600-58-0x0000000004870000-0x00000000048E0000-memory.dmpFilesize
448KB
-
memory/1600-55-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1716-73-0x0000000000000000-mapping.dmp
-
memory/1716-74-0x0000000000850000-0x0000000000859000-memory.dmpFilesize
36KB
-
memory/1716-75-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1716-76-0x0000000002220000-0x0000000002523000-memory.dmpFilesize
3.0MB
-
memory/1716-77-0x0000000001DF0000-0x0000000001E7F000-memory.dmpFilesize
572KB
-
memory/1716-79-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB