Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
17/07/2023, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Proforma Invoice.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Proforma Invoice.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Proforma Invoice.exe
- Size 254KB
- Sample230717-tegppsda92
- SHA256 a164652a4336afd460b41b4b744547c5f7999e35ae5b8ccf1abbc6bb2d2c5a32
- MD5 ef8e7da383b8604b3341909a02d937f9
- SHA1 645b8308c99bbfa5da61478ed17f6b143ea8d94a
- SHA512 081a6aaac5437d38441c524b39851431ac646c4893e0f4f88358279d89c06b975c61aee0a48b5f49b3cd1dead5f618377793f8ecdb5f60a6eaed7dce251cda22
- SSDEEP 6144:/Ya6kT8WJCaOSkjhW2vPk2Lz+w4oGDVP8RMX8pnmJTyT:/YiT8LvSkjh9LLoumXUmJa
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation Proforma Invoice.exe - Loads dropped DLL 1 IoCs
pid Process 1568 Proforma Invoice.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1568 set thread context of 1444 1568 Proforma Invoice.exe 86 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe 1444 Proforma Invoice.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1568 Proforma Invoice.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1444 Proforma Invoice.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1568 wrote to memory of 1444 1568 Proforma Invoice.exe 86 PID 1568 wrote to memory of 1444 1568 Proforma Invoice.exe 86 PID 1568 wrote to memory of 1444 1568 Proforma Invoice.exe 86 PID 1568 wrote to memory of 1444 1568 Proforma Invoice.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsz29BD.tmp\rxrzsyn.dll
- Size 11KB
- SHA256 5cd6a707f12450e3effde9db7b4e4d764dd907522995ae9e9964a064d1d9eff2
- MD5 01415eec4f4b8a3164d2ae1608d8872a
- SHA1 59af6aa4bf2dc572f7303a9a3bf3ab3437abe95d
- SHA512 9ead91da002cef53a171d56fb4bf8aeca3b2bdf49a5de3a127a277dbbb0930668598dfe87e5e8cf8ef31d19bf841b9bd6e5712ad841d90d7a345a59e00240481
- SSDEEP 192:qIZ7O78X3nmVE8X3pETtXiA3KkMv6EiHTZreQcLsjNk:qK7uL28ETtBkuTZreNLsj2
- MD5 SHA1 SHA512 SSDEEP