84291d10881f84cd06dd28dc30dfe76d6b8c8920f0dc63e7b068a5a03699bd90

Analysis

max time kernel
145s
max time network
78s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Invoice.exe
Size

288KB
MD5

b6a83e939d77b59e15d211d4643422df
SHA1

2d0fae89ba336d08b690b88b365a51cf5f258799
SHA256

84291d10881f84cd06dd28dc30dfe76d6b8c8920f0dc63e7b068a5a03699bd90
SHA512

53f6ab93f6309441b1ad0911d94622e835b28a261f8c9695d8906f62453563d4d10c56d4b7232733e2c1128d337eca198d4da00c882ddf0fc9ddde867aee01d8
SSDEEP

6144:/Ya6y3oXELs2URiSsD+KcYOZrPp8KfCeM9QFBHyH3jzZk1oATFQ:/Yk3o0A2UR71ZZrPpzC88TdZATq

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Control Panel\International\Geo\Nation	Invoice.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	Invoice.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 2884	2364	Invoice.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe
2884	Invoice.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2364	Invoice.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	Invoice.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2884	2364	Invoice.exe	27
PID 2364 wrote to memory of 2884	2364	Invoice.exe	27
PID 2364 wrote to memory of 2884	2364	Invoice.exe	27
PID 2364 wrote to memory of 2884	2364	Invoice.exe	27
PID 2364 wrote to memory of 2884	2364	Invoice.exe	27

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5E1A.tmp\ywbeeo.dll

Filesize
83KB

MD5
105dd5a40e5bd5d9be206efab585495e

SHA1
38a89da5cd58d5efc09eed07f25d30423967d4ed

SHA256
0522b3f356d73a4508e12be4f79933120f3273325b1c7ae9c4b2b357d13c4df4

SHA512
f57af5f9119d473fdf72aab8122b4801087c3142388d11249147d6bbfa0149923fa176a15cef1aa006294bcf014b158e49cb84564e8d1b43ca0603873e5c2159

Download Submit
\Users\Admin\AppData\Local\Temp\nso5E1A.tmp\ywbeeo.dll

Filesize
83KB

MD5
105dd5a40e5bd5d9be206efab585495e

SHA1
38a89da5cd58d5efc09eed07f25d30423967d4ed

SHA256
0522b3f356d73a4508e12be4f79933120f3273325b1c7ae9c4b2b357d13c4df4

SHA512
f57af5f9119d473fdf72aab8122b4801087c3142388d11249147d6bbfa0149923fa176a15cef1aa006294bcf014b158e49cb84564e8d1b43ca0603873e5c2159

Download Submit
memory/2884-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2884-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2884-63-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/2884-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download