096dc9d1c1b50a5dfb5dcec64183b2901441b43343308c890b4a82293eb18f39

General

Target

Confirm revised invoice to proceed with payment ASAP.exe
Size

601KB
MD5

d91260a98896839dfccebffc6c11a13f
SHA1

589c7a5ad66e3ed75301cbdfe7a22646a73c3800
SHA256

45dec1fc7a43e44be22a5bc161baaff3a7573562b1574246e5c59235620d715e
SHA512

b24e354ff9c4be264aab73611033df2159a6ae5be3501bb392cbc45f5f3f6f64934e6318a441c72a4e4c4f3ae4abad064aaf559a77689a30357282c8d4d59d12
SSDEEP

12288:Z22iNds1zpmnchs+TSIbQKJ1SzfCaAfoAgLI+OCuZm5DvLIAibDfWy:E1A9ach/mOhSTCRo2cq

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1812 set thread context of 1740	1812	RegSvcs.exe	25

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1740	Confirm revised invoice to proceed with payment ASAP.exe
1740	Confirm revised invoice to proceed with payment ASAP.exe
1812	RegSvcs.exe
804	powershell.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1812	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	Confirm revised invoice to proceed with payment ASAP.exe
Token: SeDebugPrivilege	1812	RegSvcs.exe
Token: SeDebugPrivilege	804	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 804	1740	Confirm revised invoice to proceed with payment ASAP.exe	26
PID 1740 wrote to memory of 804	1740	Confirm revised invoice to proceed with payment ASAP.exe	26
PID 1740 wrote to memory of 804	1740	Confirm revised invoice to proceed with payment ASAP.exe	26
PID 1740 wrote to memory of 804	1740	Confirm revised invoice to proceed with payment ASAP.exe	26
PID 1740 wrote to memory of 324	1740	Confirm revised invoice to proceed with payment ASAP.exe	28
PID 1740 wrote to memory of 324	1740	Confirm revised invoice to proceed with payment ASAP.exe	28
PID 1740 wrote to memory of 324	1740	Confirm revised invoice to proceed with payment ASAP.exe	28
PID 1740 wrote to memory of 324	1740	Confirm revised invoice to proceed with payment ASAP.exe	28
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1812	1740	Confirm revised invoice to proceed with payment ASAP.exe	30
PID 1740 wrote to memory of 1020	1740	Confirm revised invoice to proceed with payment ASAP.exe	32
PID 1740 wrote to memory of 1020	1740	Confirm revised invoice to proceed with payment ASAP.exe	32
PID 1740 wrote to memory of 1020	1740	Confirm revised invoice to proceed with payment ASAP.exe	32
PID 1740 wrote to memory of 1020	1740	Confirm revised invoice to proceed with payment ASAP.exe	32

C:\Users\Admin\AppData\Local\Temp\Confirm revised invoice to proceed with payment ASAP.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm revised invoice to proceed with payment ASAP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EXAJsmpOrn.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:804
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EXAJsmpOrn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1324
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6C5.tmp

Filesize
1KB

MD5
4cdeb8f4a4686bc38b40ae45461dc001

SHA1
a75eddcf75b9b578038dbd169039fec4b9177b15

SHA256
490149c40ba9204fb032c2812a752caff2776a644ab94bda03e19657e71af441

SHA512
0d321729c1c47b03eedea4b6e31a5aed0e56f7293ce1024e7b0887554985431d214b2eeef8c5ee3903eb228156a64e4ad9f18245b58a63470256c9683956073a

Download Submit
memory/804-74-0x0000000002360000-0x00000000023A0000-memory.dmp

Filesize
256KB

Download
memory/804-73-0x0000000002360000-0x00000000023A0000-memory.dmp

Filesize
256KB

Download
memory/1740-71-0x00000000051A0000-0x00000000052BE000-memory.dmp

Filesize
1.1MB

Download
memory/1740-55-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download
memory/1740-56-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/1740-57-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download
memory/1740-58-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1740-59-0x0000000007420000-0x000000000748E000-memory.dmp

Filesize
440KB

Download
memory/1740-54-0x0000000000EE0000-0x0000000000F7C000-memory.dmp

Filesize
624KB

Download
memory/1812-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1812-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-75-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads