Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE 103321.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PROFORMA INVOICE 103321.rar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
PROFORMA INVOICE 103321.exe
Resource
win7-20220901-en
General
-
Target
PROFORMA INVOICE 103321.exe
-
Size
916KB
-
MD5
6b34c7d21457240410f7526870fb3cc8
-
SHA1
ad4f885afeefe8d5c06f8ed14736705fb0b527f1
-
SHA256
4e299e221bff547ce81f39f447b914d120e8411bd4d38a5cf7014e5241e757ad
-
SHA512
1a8a7160adf1acea7cd76a7b739129f95afe931d9e5544d874e20d7f9c330c297618cb1f7cb69ced06fa22aaf95ef68dbf1df1e6898143061c8c360b3b48b61e
-
SSDEEP
12288:2ZMBqPwNK7sb7/sn1gSp4JZjAH1wBjGrCwDBo6RU2snF90NcZnbhR9jqI:he7w7En1gSp4TjQw5+CCrKFSNYbX9jn
Malware Config
Extracted
formbook
d8ax
wQDD4HkJc+vErnk=
j7vdn039QTY5Gcs43SDb8R4gwLgFCI7s
ZqPN0enMl4As
kKK00fOMq6KZmHv6kZjEiTm3l1o=
CxCTti/0Dcs5qly/AVHoTg==
5TwVtD3wcevErnk=
/ieoWNXMl4As
caK67QvHGhmiEuKpidX2RA==
Bbyy3J6D1Qw=
LV5N2gOocvpbA/OB/w==
k7k2OMNsBY67libDOi4=
wuDokhS1jLo4mA==
RVGz6anMl4As
la40BCHFwoI/rpugbdoaWQ==
XmVnfY0nNACG5si5u8Ds6F79xw==
dpyQTuytl0/bShsFIYUaHRzIL4quYwxgTA==
yvmesDDPpTSrLhf5GlvvdaCZekhAsg==
obTEXhervaSWkSbDOi4=
ClZogXcOT1DcPyvgOKJM
Drlokv/cjLo4mA==
V4oZcMaLgjLLXfXt+g==
8BRWc4dCh+vErnk=
gZs1StGIWxHCXfXt+g==
kNWGiRXrqi1iPQlc/GU8hYQ=
nJQn54uLlWECXfXt+g==
2AU1AaNCuTog/+7M7vL++nxyjAYhug==
gLTciPW1cBLCXfXt+g==
7h7ZsWhwmJQ9Yhfd
NlFTcDIRY5WSlA==
KVxtg4EkZ5y2mybDOi4=
vc7dlj8GnRU5KNelbdoaWQ==
+hol4ZAxhsDDnSbDOi4=
0tlf7fGn6GENckSlV1dqs5o=
FVb6DpNaVBG+XfXt+g==
UNsBOPIUJJ8ud24=
1SbXAalJ3GCPfjtUDDXEVg==
OV4aRNJh6jVcNvy/xcS5Kjxc
hZqaRL5W4UlWPx16GpE2ySHpekhAsg==
QmTiBn1ALazBlibDOi4=
9jToDI8w5WJ7WCyhMmU8hYQ=
ECSrOEcC+aAef2VeVSE/tjm3l1o=
0tp9JDPs5pgphEIP41zldsC8zw==
HD7IzWMMmQt4I9wzbdoaWQ==
cKdMehnTerbJqCbDOi4=
RWhnXi5ZIGqjgmQ=
0fRlIEMHSE49Yhfd
bqrQ+DHBm4g1rJSRvsLs6F79xw==
rOoQJyHHH1VnPv1O1QiiuwbYnW74
g4SVt952e2RtcD6fKWU8hYQ=
R1huOuCLWV+pfwLgOKJM
pChMES6ijLo4mA==
9yWJOJyjtdIgzoTTZrq4iDm3l1o=
utfRc/OFAD4wFdk3bdoaWQ==
fpIYx++FK5+9spOpmf8YTg==
Jt0GgpzIjLo4mA==
srzO4u1vfXUKglbgOKJM
oK5G2NiBmWz7VRH241zldsC8zw==
LzzMZHMwGtevgmQ=
DFPw/EEd4Yc9Yhfd
cL7kACe5n07ZcfTD4w==
g8QFmC3VK2KCt0mmKyw=
mtl0BPzHDEsEWf1g3yC7UQ==
bZ/RdPiCxerz56ebbdoaWQ==
ZYALGqMrqw6bCd83bdoaWQ==
linktau-roads.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PROFORMA INVOICE 103321.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation PROFORMA INVOICE 103321.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PROFORMA INVOICE 103321.exePROFORMA INVOICE 103321.exeraserver.exedescription pid process target process PID 4804 set thread context of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 3256 set thread context of 2520 3256 PROFORMA INVOICE 103321.exe Explorer.EXE PID 372 set thread context of 2520 372 raserver.exe Explorer.EXE -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
PROFORMA INVOICE 103321.exeraserver.exepid process 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2520 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PROFORMA INVOICE 103321.exeraserver.exepid process 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 3256 PROFORMA INVOICE 103321.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe 372 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
PROFORMA INVOICE 103321.exeExplorer.EXEraserver.exedescription pid process Token: SeDebugPrivilege 3256 PROFORMA INVOICE 103321.exe Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE Token: SeDebugPrivilege 372 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PROFORMA INVOICE 103321.exeExplorer.EXEraserver.exedescription pid process target process PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 4804 wrote to memory of 3256 4804 PROFORMA INVOICE 103321.exe PROFORMA INVOICE 103321.exe PID 2520 wrote to memory of 372 2520 Explorer.EXE raserver.exe PID 2520 wrote to memory of 372 2520 Explorer.EXE raserver.exe PID 2520 wrote to memory of 372 2520 Explorer.EXE raserver.exe PID 372 wrote to memory of 1756 372 raserver.exe Firefox.exe PID 372 wrote to memory of 1756 372 raserver.exe Firefox.exe PID 372 wrote to memory of 1756 372 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE 103321.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3256 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1756
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-153-0x0000000001240000-0x000000000126D000-memory.dmpFilesize
180KB
-
memory/372-151-0x00000000030D0000-0x000000000315F000-memory.dmpFilesize
572KB
-
memory/372-150-0x0000000003160000-0x00000000034AA000-memory.dmpFilesize
3.3MB
-
memory/372-148-0x00000000002A0000-0x00000000002BF000-memory.dmpFilesize
124KB
-
memory/372-149-0x0000000001240000-0x000000000126D000-memory.dmpFilesize
180KB
-
memory/372-147-0x0000000000000000-mapping.dmp
-
memory/2520-146-0x0000000003260000-0x000000000335E000-memory.dmpFilesize
1016KB
-
memory/2520-154-0x00000000082D0000-0x00000000083EA000-memory.dmpFilesize
1.1MB
-
memory/2520-152-0x00000000082D0000-0x00000000083EA000-memory.dmpFilesize
1.1MB
-
memory/3256-137-0x0000000000000000-mapping.dmp
-
memory/3256-143-0x0000000000FC0000-0x000000000130A000-memory.dmpFilesize
3.3MB
-
memory/3256-144-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/3256-145-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/3256-142-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/3256-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3256-140-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3256-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4804-132-0x0000000000140000-0x000000000022A000-memory.dmpFilesize
936KB
-
memory/4804-136-0x0000000007690000-0x000000000772C000-memory.dmpFilesize
624KB
-
memory/4804-135-0x0000000004BB0000-0x0000000004BBA000-memory.dmpFilesize
40KB
-
memory/4804-134-0x0000000004C40000-0x0000000004CD2000-memory.dmpFilesize
584KB
-
memory/4804-133-0x00000000051F0000-0x0000000005794000-memory.dmpFilesize
5.6MB