fe985b1cc581849d8bf8a73c1e09c2ff6ef636ba836deff5d045723456333f0e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice_pdf.exe
Size 1.2MB
Sample240809-qlnj2svdme
SHA256 fe985b1cc581849d8bf8a73c1e09c2ff6ef636ba836deff5d045723456333f0e
MD5 05ed3ff4048cc0a6e5a84af97f284c9a
SHA1 e6086bdd2adfcad74ae69d959608bdec754b38c0
SHA512 b5da4d58d8bfc93d8d02a4ace25cbe3cffcdd11103114d145b4759fe0ee574c75c8175260330d44c1a4be49683f59145c8426e3171e4ec7b9e41e85441bb05fc
SSDEEP 24576:UAHnh+eWsN3skA4RV1Hom2KXMmHajQfj5v0JJ94gwT5:jh+ZkldoPK8Yaj88JJ94gg
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 2820	4492	Invoice_pdf.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice_pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe
2820	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4492	Invoice_pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4492	Invoice_pdf.exe
4492	Invoice_pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4492	Invoice_pdf.exe
4492	Invoice_pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2820	4492	Invoice_pdf.exe	86
PID 4492 wrote to memory of 2820	4492	Invoice_pdf.exe	86
PID 4492 wrote to memory of 2820	4492	Invoice_pdf.exe	86
PID 4492 wrote to memory of 2820	4492	Invoice_pdf.exe	86

C:\Users\Admin\AppData\Local\Temp\Invoice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut738A.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut738A.tmp
Size 280KB
SHA256 6b32aa9a5a860cc4dfbdb035f5560bd7540f6decd357cd097826ed666d56baa3
MD5 c7dcb7253697bc71afcb553a7a72519f
SHA1 e2d683dd52f2805370c254f239978f026e2f6860
SHA512 389348fc316549cc6ce5aec0c6497c90e01106fa7e8ddb0bbe309a5fefa389de7b5b0ce4420a5a4b948eff9bb320c7851bf0763222cdfd5ca0051312ac5904ef
SSDEEP 6144:vfQQjNY/ySor/ZTy36JOXPAQKRJ/w8rhsIBjTkcrn:Q2+/ySQ/ZTyqePA3RJ/wFgjwon
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2820-14-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2820-15-0x0000000001800000-0x0000000001B4A000-memory.dmp

Download

memory/2820-16-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2820-17-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4492-13-0x0000000003810000-0x0000000003814000-memory.dmp

Download