3ef009e7f463f7547633cf58782dc38fe61e38e9e4fcbedf2f70311c6fa0e5a7

General

Target

PROFORMA INVOICE.exe
Size

695KB
MD5

1bff7b7c5fb02011f9916e1a352437d4
SHA1

0fa608826609fc8b0156c3cb16446ede0557051a
SHA256

3ef009e7f463f7547633cf58782dc38fe61e38e9e4fcbedf2f70311c6fa0e5a7
SHA512

a24d1de3971bc5ef7829f53964ba50dcb827684d1f6d8d8e9b9c13a2a76557e4f465d5e1351683206322871bcd62bd370ef27aadbd68cda179b5c370346d556d
SSDEEP

12288:V7C9rvd+GMwgYn//56a+oHesNqOpI7hsJiVIxQ7/xsOGpYXGatL9MnPDrq:V+rvdFMgn/BbeslWhsJiGxQbxsOGWVt9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 940 set thread context of 2248	940	PROFORMA INVOICE.exe	97
PID 2248 set thread context of 3356	2248	RegSvcs.exe	57
PID 2248 set thread context of 1496	2248	RegSvcs.exe	101
PID 1496 set thread context of 3356	1496	iexpress.exe	57
PID 1496 set thread context of 1052	1496	iexpress.exe	102

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	iexpress.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
940	PROFORMA INVOICE.exe
940	PROFORMA INVOICE.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
2248	RegSvcs.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2248	RegSvcs.exe
3356	Explorer.EXE
3356	Explorer.EXE
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe
1496	iexpress.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	PROFORMA INVOICE.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 940 wrote to memory of 2248	940	PROFORMA INVOICE.exe	97
PID 3356 wrote to memory of 1496	3356	Explorer.EXE	101
PID 3356 wrote to memory of 1496	3356	Explorer.EXE	101
PID 3356 wrote to memory of 1496	3356	Explorer.EXE	101
PID 1496 wrote to memory of 1052	1496	iexpress.exe	102
PID 1496 wrote to memory of 1052	1496	iexpress.exe	102

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2248
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\SysWOW64\iexpress.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-6-0x0000000006B70000-0x0000000006C16000-memory.dmp

Filesize
664KB

Download
memory/940-10-0x0000000006FF0000-0x000000000707A000-memory.dmp

Filesize
552KB

Download
memory/940-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

Filesize
5.6MB

Download
memory/940-3-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/940-4-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/940-5-0x0000000005220000-0x000000000522A000-memory.dmp

Filesize
40KB

Download
memory/940-8-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/940-14-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/940-1-0x0000000000710000-0x00000000007C4000-memory.dmp

Filesize
720KB

Download
memory/940-9-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/940-0-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/940-11-0x00000000096A0000-0x000000000973C000-memory.dmp

Filesize
624KB

Download
memory/940-7-0x0000000006C40000-0x0000000006C58000-memory.dmp

Filesize
96KB

Download
memory/1052-38-0x0000024E2F6F0000-0x0000024E2F7B8000-memory.dmp

Filesize
800KB

Download
memory/1496-25-0x0000000002510000-0x000000000285A000-memory.dmp

Filesize
3.3MB

Download
memory/1496-22-0x00000000004F0000-0x000000000052F000-memory.dmp

Filesize
252KB

Download
memory/1496-29-0x00000000004F0000-0x000000000052F000-memory.dmp

Filesize
252KB

Download
memory/1496-27-0x0000000002360000-0x00000000023FE000-memory.dmp

Filesize
632KB

Download
memory/1496-30-0x0000000002360000-0x00000000023FE000-memory.dmp

Filesize
632KB

Download
memory/1496-26-0x00000000004F0000-0x000000000052F000-memory.dmp

Filesize
252KB

Download
memory/1496-21-0x00000000004F0000-0x000000000052F000-memory.dmp

Filesize
252KB

Download
memory/2248-19-0x0000000001050000-0x000000000106F000-memory.dmp

Filesize
124KB

Download
memory/2248-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2248-24-0x0000000001050000-0x000000000106F000-memory.dmp

Filesize
124KB

Download
memory/2248-15-0x0000000001530000-0x000000000187A000-memory.dmp

Filesize
3.3MB

Download
memory/2248-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2248-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2248-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2248-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3356-20-0x000000000D960000-0x000000000FB0C000-memory.dmp

Filesize
33.7MB

Download
memory/3356-31-0x0000000002FD0000-0x000000000307E000-memory.dmp

Filesize
696KB

Download
memory/3356-32-0x0000000002FD0000-0x000000000307E000-memory.dmp

Filesize
696KB

Download
memory/3356-28-0x000000000D960000-0x000000000FB0C000-memory.dmp

Filesize
33.7MB

Download
memory/3356-39-0x0000000002FD0000-0x000000000307E000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing