b925013a9be16ff7d92304e0a913d625401edd0876a1ea76b5e5fb974f436d8d

Resubmissions

25-05-2023 04:47

230525-fekjpsgb23 10

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2023 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice_2505.exe
Size

2.4MB
MD5

a8f0d2b85e0c077a27bbe9b6c814716f
SHA1

2da8049841af9719ef1f076b4815cea1d85f81f6
SHA256

8e23a23412468de86e3bf6bc883fa14102e30d6d452a656a578c3a500aac76a2
SHA512

ec399e52f75731d5ef588d30242f639399f7e92be78e923c3328a0331d797db4ecd952684dffd229df6eb3652bc215eb8af2136234f89b328f621dedfafc0f17
SSDEEP

49152:lkWk5cS7a+9XYaQBZehc4mTYJ78V9gyBn4ccfmP/SA8N:RajJqZ942KQV9hp41fmP/SA8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4236	Invoice_2505.exe
4236	Invoice_2505.exe
4236	Invoice_2505.exe
2832	Invoice_2505.exe
2832	Invoice_2505.exe
2832	Invoice_2505.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1164	4236	Invoice_2505.exe	84
PID 4236 wrote to memory of 1164	4236	Invoice_2505.exe	84
PID 4236 wrote to memory of 1164	4236	Invoice_2505.exe	84
PID 2832 wrote to memory of 1552	2832	Invoice_2505.exe	99
PID 2832 wrote to memory of 1552	2832	Invoice_2505.exe	99
PID 2832 wrote to memory of 1552	2832	Invoice_2505.exe	99

C:\Users\Admin\AppData\Local\Temp\Invoice_2505.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice_2505.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4704

C:\Users\Admin\AppData\Local\Temp\Invoice_2505.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice_2505.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads