c0b13c8cf91f75fb3ae9448b92656ccf90dbf374855d10add7d8a972bdc5d5b4

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/02/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAYMENT INVOICE.exe
Size 1.1MB
Sample240207-hmhfesedd4
SHA256 c0b13c8cf91f75fb3ae9448b92656ccf90dbf374855d10add7d8a972bdc5d5b4
MD5 fd93188a0049f56a08e111b0dd4da4fc
SHA1 8720834732644f7f964767532504dd19321a0cf3
SHA512 d2e33474337761df31c8b7c3a9c5b4ac820b66aed1606d98ca17290485d1c68c425474035c7c36c6f7aeebe825b623c2e0b97a1412469a2ea71feda90c88fa81
SSDEEP 24576:qie8N6Z7zncHUAlTNA2YSqoLaBKVTTSAgv9cx:A8N6Z7zc0s1aoLaQWAgv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
1948	PAYMENT INVOICE.exe
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	PAYMENT INVOICE.exe
Token: SeDebugPrivilege	2680	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2680	1948	PAYMENT INVOICE.exe	28
PID 1948 wrote to memory of 2680	1948	PAYMENT INVOICE.exe	28
PID 1948 wrote to memory of 2680	1948	PAYMENT INVOICE.exe	28
PID 1948 wrote to memory of 2680	1948	PAYMENT INVOICE.exe	28
PID 1948 wrote to memory of 2708	1948	PAYMENT INVOICE.exe	30
PID 1948 wrote to memory of 2708	1948	PAYMENT INVOICE.exe	30
PID 1948 wrote to memory of 2708	1948	PAYMENT INVOICE.exe	30
PID 1948 wrote to memory of 2708	1948	PAYMENT INVOICE.exe	30
PID 1948 wrote to memory of 2872	1948	PAYMENT INVOICE.exe	32
PID 1948 wrote to memory of 2872	1948	PAYMENT INVOICE.exe	32
PID 1948 wrote to memory of 2872	1948	PAYMENT INVOICE.exe	32
PID 1948 wrote to memory of 2872	1948	PAYMENT INVOICE.exe	32
PID 1948 wrote to memory of 2772	1948	PAYMENT INVOICE.exe	33
PID 1948 wrote to memory of 2772	1948	PAYMENT INVOICE.exe	33
PID 1948 wrote to memory of 2772	1948	PAYMENT INVOICE.exe	33
PID 1948 wrote to memory of 2772	1948	PAYMENT INVOICE.exe	33
PID 1948 wrote to memory of 2616	1948	PAYMENT INVOICE.exe	34
PID 1948 wrote to memory of 2616	1948	PAYMENT INVOICE.exe	34
PID 1948 wrote to memory of 2616	1948	PAYMENT INVOICE.exe	34
PID 1948 wrote to memory of 2616	1948	PAYMENT INVOICE.exe	34
PID 1948 wrote to memory of 2520	1948	PAYMENT INVOICE.exe	35
PID 1948 wrote to memory of 2520	1948	PAYMENT INVOICE.exe	35
PID 1948 wrote to memory of 2520	1948	PAYMENT INVOICE.exe	35
PID 1948 wrote to memory of 2520	1948	PAYMENT INVOICE.exe	35
PID 1948 wrote to memory of 2740	1948	PAYMENT INVOICE.exe	36
PID 1948 wrote to memory of 2740	1948	PAYMENT INVOICE.exe	36
PID 1948 wrote to memory of 2740	1948	PAYMENT INVOICE.exe	36
PID 1948 wrote to memory of 2740	1948	PAYMENT INVOICE.exe	36

C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FcrUBkvxpsOqQP.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FcrUBkvxpsOqQP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9DD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
  2⤵
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB9DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB9DD.tmp
Size 1KB
SHA256 51fb4d46f5c1e2e3abfffa157e1d9173e3f4203250e8e6f1680b598c2cc280cf
MD5 6c0f3cc69417fbb60e7f18d6ad779f81
SHA1 54ef5268c4a4d783b2d2ee45064258acf69c262f
SHA512 4e8b302b57dc5282d47c767fae0cf3d22cf57e4c9ab2dfa48495b4947f617b5641dec105d83cd31daa3e7cf5f578acff9801d4e7a658ab90bd9f27219f052f52
MD5 SHA1 SHA512

Submit Download

memory/1948-6-0x0000000005D50000-0x0000000005E10000-memory.dmp

Download

memory/1948-14-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/1948-3-0x0000000000510000-0x0000000000524000-memory.dmp

Download

memory/1948-4-0x0000000000540000-0x000000000054A000-memory.dmp

Download

memory/1948-5-0x0000000000730000-0x000000000073E000-memory.dmp

Download

memory/1948-0-0x00000000003E0000-0x0000000000506000-memory.dmp

Download

memory/1948-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/1948-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Download

memory/2680-15-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Download

memory/2680-16-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Download

memory/2680-17-0x0000000002610000-0x0000000002650000-memory.dmp

Download

memory/2680-19-0x0000000002610000-0x0000000002650000-memory.dmp

Download

memory/2680-18-0x0000000002610000-0x0000000002650000-memory.dmp

Download

memory/2680-20-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Download