Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
05/07/2023, 06:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-20230703-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target INVOICE.exe
- Size 370KB
- Sample230705-hfr2aaba37
- SHA256 69158a09d4c8167f9e137da4fca102ffdeb9f5478d46446a34dd3bbe1ccfa1f6
- MD5 dc2e58313ea339e7264e902e913337d5
- SHA1 866029cd101c751fad23c0409bfc3235eb0bc958
- SHA512 6295c5080b433fda4541e25e03b682e667c8be21af97d91d253124a218b2ef3d5a7cff8301e36865094b65944a03f526bf73ab08ba2fa2ce43767d39b027d640
- SSDEEP 6144:vYa6PZT8bINm10JCFdButfHLdCKehznPI2TfG/dZSsBsNsHnl1P4IDxzPpmA/Nye:vYF+bI8EMdIfrdDeZPNfer3OsH7Dx7pL
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation INVOICE.exe - Loads dropped DLL 1 IoCs
pid Process 736 INVOICE.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueajsoxt = "C:\\Users\\Admin\\AppData\\Roaming\\kdyienws\\clhq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\INVOICE.exe\"" INVOICE.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 736 set thread context of 4740 736 INVOICE.exe 85 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe 4740 INVOICE.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 736 INVOICE.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4740 INVOICE.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 736 wrote to memory of 4740 736 INVOICE.exe 85 PID 736 wrote to memory of 4740 736 INVOICE.exe 85 PID 736 wrote to memory of 4740 736 INVOICE.exe 85 PID 736 wrote to memory of 4740 736 INVOICE.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsb8A21.tmp\cdwwvi.dll
- Size 277KB
- SHA256 23cbdafcc7b4ea7a1e0ad58849c96d2e6ad1be1ae39f4fb37eb37b1d6bad515c
- MD5 00b151503f4b98c58a63e2de957139a0
- SHA1 3c0d929254c09684d3076785f914d4d8d55530a5
- SHA512 ee6f112eee98759ed9a7e2bf849fd6409de6586bc936b191fb75ca927c1256d05a88481290d23260df20411a659138856db010e30e14e659a6329320831a04aa
- SSDEEP 6144:FVHrXy5nd7p+xqmTuJtkMkVLRRB35XuCapPqf/:F9W5dN+xqmTuJtwfuCaJqf/
- MD5 SHA1 SHA512 SSDEEP