Overview

overview

8

Static

static

6

lnvoice-12...42.pdf

windows10-2004-x64

6

lnvoice-12...42.pdf

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lnvoice-1205700442.pdf

  • Size

    51KB

  • Sample

    240509-ncq8gaef2t

  • MD5

    00ddbd030ad7e3937c2bd2a3b9eb5bc8

  • SHA1

    8c491b21744426105813f2d70d59da67a420662e

  • SHA256

    bac254771e7542c3db185f2f91a861bc9790d82cf4e64e77568346594fc40c72

  • SHA512

    44f30df5a027b9087a34e14b848f63811f5895e099b2db163852d23ebe7265d467329dcc4e47e562b5b10c0948d4195e2ed499130b61a5595008ff32cc7de585

  • SSDEEP

    384:qpy6SDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz3QznMlMNRwH7Tx6yso:qpy6ST7hWGTO/KNznMlUwHfj

Score
8/10
agilenetexecutionjavascriptlinkpdfpersistence

Malware Config

Targets

    • Target

      lnvoice-1205700442.pdf

    • Size

      51KB

    • MD5

      00ddbd030ad7e3937c2bd2a3b9eb5bc8

    • SHA1

      8c491b21744426105813f2d70d59da67a420662e

    • SHA256

      bac254771e7542c3db185f2f91a861bc9790d82cf4e64e77568346594fc40c72

    • SHA512

      44f30df5a027b9087a34e14b848f63811f5895e099b2db163852d23ebe7265d467329dcc4e47e562b5b10c0948d4195e2ed499130b61a5595008ff32cc7de585

    • SSDEEP

      384:qpy6SDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz3QznMlMNRwH7Tx6yso:qpy6ST7hWGTO/KNznMlUwHfj

    Score
    8/10
    agilenetexecutionpersistence

    • Blocklisted process makes network request

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks