Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
03/08/2023, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
revised_invoice.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
revised_invoice.exe
Resource
win10v2004-20230703-en
General
-
Target
revised_invoice.exe
-
Size
828KB
-
MD5
aba5cc62cc5479e1f5f5c733d750520a
-
SHA1
02670702f7c840e382edabab7933b5079112b2fe
-
SHA256
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
-
SHA512
2e17f86ff811d65d42a16424f439fb6cf236bd5785eb282830242755a081ef9bdefec051aeb5e853d2e326c36cccb0f97178269b562a736b17f10436280edcb5
-
SSDEEP
12288:QEKaJFds+DAOBwjoe1qtWiRW95ZZUiGTrj4z1/c7:5dYjoeYWJdZvd/O
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2248 revised_invoice.exe 2232 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2248 revised_invoice.exe Token: SeDebugPrivilege 2232 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2232 2248 revised_invoice.exe 30 PID 2248 wrote to memory of 2232 2248 revised_invoice.exe 30 PID 2248 wrote to memory of 2232 2248 revised_invoice.exe 30 PID 2248 wrote to memory of 2232 2248 revised_invoice.exe 30 PID 2248 wrote to memory of 2820 2248 revised_invoice.exe 32 PID 2248 wrote to memory of 2820 2248 revised_invoice.exe 32 PID 2248 wrote to memory of 2820 2248 revised_invoice.exe 32 PID 2248 wrote to memory of 2820 2248 revised_invoice.exe 32 PID 2248 wrote to memory of 2260 2248 revised_invoice.exe 34 PID 2248 wrote to memory of 2260 2248 revised_invoice.exe 34 PID 2248 wrote to memory of 2260 2248 revised_invoice.exe 34 PID 2248 wrote to memory of 2260 2248 revised_invoice.exe 34 PID 2248 wrote to memory of 2836 2248 revised_invoice.exe 35 PID 2248 wrote to memory of 2836 2248 revised_invoice.exe 35 PID 2248 wrote to memory of 2836 2248 revised_invoice.exe 35 PID 2248 wrote to memory of 2836 2248 revised_invoice.exe 35 PID 2248 wrote to memory of 2956 2248 revised_invoice.exe 36 PID 2248 wrote to memory of 2956 2248 revised_invoice.exe 36 PID 2248 wrote to memory of 2956 2248 revised_invoice.exe 36 PID 2248 wrote to memory of 2956 2248 revised_invoice.exe 36 PID 2248 wrote to memory of 2064 2248 revised_invoice.exe 37 PID 2248 wrote to memory of 2064 2248 revised_invoice.exe 37 PID 2248 wrote to memory of 2064 2248 revised_invoice.exe 37 PID 2248 wrote to memory of 2064 2248 revised_invoice.exe 37 PID 2248 wrote to memory of 2868 2248 revised_invoice.exe 38 PID 2248 wrote to memory of 2868 2248 revised_invoice.exe 38 PID 2248 wrote to memory of 2868 2248 revised_invoice.exe 38 PID 2248 wrote to memory of 2868 2248 revised_invoice.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VCYZNOqT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VCYZNOqT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E2B.tmp"2⤵
- Creates scheduled task(s)
PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"2⤵PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"2⤵PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"2⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"C:\Users\Admin\AppData\Local\Temp\revised_invoice.exe"2⤵PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52138db1725037b9afb08e1378d467431
SHA11ae329728fbe571d659319fa8960df71ddb5b9ca
SHA2564eadbe73e4ea6ddd26f8b1168eb7a5f88aa4eeba2ab430be1650956e380d9217
SHA512add803966ffefb58418df0966510cac03ee36b1e5abaf4eab6668faa7eb45bab126acc5bcdb45eb80150fe87030846000086c730b7a4ce28e938c8faeba13752