Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
20/07/2023, 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Invoice.exe
- Size 272KB
- Sample230720-l18rbafc65
- SHA256 94509d1a6070cfbaeeee0e3de30bf14dce5f4b28bfeef4ab3cf9bedbd0a07dd1
- MD5 4b13c07a48e57799e54f6e38e34ff6be
- SHA1 6a0290c82cb922e60e949b7f52e9c9fe031433f1
- SHA512 59fa40ea070de7421643c51e5c8a140ef5cd2296568fad594f230940f940a813e368e68fa22bc738fe453afa8d1587c00967c8880ae42cd07ad8fbf3279e2514
- SSDEEP 6144:/Ya6xeXPYBCWD04uosQ3v4nDR/dxo0u4pSDZJhFlrUdGv:/YbefYQ6eBQfMR/no4m/HKd4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation Invoice.exe - Loads dropped DLL 1 IoCs
pid Process 180 Invoice.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 180 set thread context of 2044 180 Invoice.exe 86 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe 2044 Invoice.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 180 Invoice.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2044 Invoice.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 180 wrote to memory of 2044 180 Invoice.exe 86 PID 180 wrote to memory of 2044 180 Invoice.exe 86 PID 180 wrote to memory of 2044 180 Invoice.exe 86 PID 180 wrote to memory of 2044 180 Invoice.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsq1412.tmp\dlmerg.dll
- Size 48KB
- SHA256 35b5117ed2ef867a91e48ea5b4c1d8cd22cb1812071027b71df7b41f6e04dc1c
- MD5 116643b03ccdb1f50f417b1c7bf4d21a
- SHA1 8b4271e65cb970cc266355cebecde0e19ced9b05
- SHA512 68eec68d252f487bc6f336789dbe46b3af1db3804e65c29507ae15bcb6aa6d0423b86ea3ce3c9b0146f8bc529a05b9349c32210805a8d2d5bcc053a600c00960
- SSDEEP 1536:fEAzJjj3/xXl2NHTABM36YIMRDTtBppqmc1a:fEAh5Qj36BMRP/ppA
- MD5 SHA1 SHA512 SSDEEP