4f3c0de5a08e918050382a42c6109fda68cc8167664065ebd98c73d761fde3f3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INV&PL.exe
Size

888KB
MD5

3d62e0fc4fca8100b42897e70a53d231
SHA1

330509cdadfcf790502287f308c30f2f273f2da3
SHA256

e8337caecb446835a9104cbc6bccf21fb76c0ab31a285a5e2049be0b1a6bc273
SHA512

bd27f9c93cd80df38221090c21a894676220129f2942e2e1884a47054ff7643de7903384e4033131b758974c876fefed86e4e6c6a30297e6e30e60968101642f
SSDEEP

12288:Q1ZBq7/ExfbSRmrZn9gHLYBrsd5dewor0FPpDI5mMXoWV2woUb+gRyd1wV1ERc1:Q1Z07/ExfbVrZn9GXd/cm05mMXzvr+qp

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2540 powershell.exe
2324 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

INV&PL.exe

description pid process target process

PID 952 set thread context of 2592 952 INV&PL.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2652 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2540 powershell.exe
2324 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2540 powershell.exe
Token: SeDebugPrivilege 2324 powershell.exe

pid	process
2540	powershell.exe
2324	powershell.exe

description	pid	process	target process
PID 952 set thread context of 2592	952	INV&PL.exe	RegSvcs.exe

pid	process
2652	schtasks.exe

pid	process
2540	powershell.exe
2324	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

INV&PL.exe

description	pid	process	target process
PID 952 wrote to memory of 2540	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2540	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2540	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2324	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2324	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2324	952	INV&PL.exe	powershell.exe
PID 952 wrote to memory of 2652	952	INV&PL.exe	schtasks.exe
PID 952 wrote to memory of 2652	952	INV&PL.exe	schtasks.exe
PID 952 wrote to memory of 2652	952	INV&PL.exe	schtasks.exe
PID 952 wrote to memory of 2592	952	INV&PL.exe	RegSvcs.exe
PID 952 wrote to memory of 2592	952	INV&PL.exe	RegSvcs.exe
PID 952 wrote to memory of 2592	952	INV&PL.exe	RegSvcs.exe
PID 952 wrote to memory of 2592	952	INV&PL.exe	RegSvcs.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\INV&PL.exe
"C:\Users\Admin\AppData\Local\Temp\INV&PL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INV&PL.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PTVhWUeYJJm.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PTVhWUeYJJm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B2C.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
PID:2592

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3B2C.tmp
Filesize
1KB

MD5
cfba8bae75d261160c1e30eeeae1ed5a

SHA1
d4f72e720cf9aed8414c562be7cbfec1ced660da

SHA256
5b9cf64b650a07409280845437c86226b04d8eaa67f535e8283995174196aa57

SHA512
064b380f1f0b068c5490a12787ff00df57c151972538d0158dbfd2d0b01842d1d2abc4e75ba029dd86acbadcdf4d42a2f2169bce719cbd7523afb4f2afa2f071

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HFZHFLC9K0PL6AP3PDW1.temp
Filesize
7KB

MD5
ab2b55345eb8d780f38442480f6fc0c9

SHA1
0405f5b1a9773fc1b1bc9e1769663e9492617d9a

SHA256
eeec9165f1a29e0aa885370c81f1eacc18152f3d15df64b53d23091f29d961f6

SHA512
6a6f7c28342d08a7b3e24ea89485a31dd404e36d6940307e382dee5ef2d4f679bcd9915631fcd93d760bca087c08e8132c5d54e0b01a8fbf49b65db36308cdaa

Download Submit
memory/952-0-0x000007FEF5C63000-0x000007FEF5C64000-memory.dmp

Filesize
4KB

Download
memory/952-1-0x000000013FA10000-0x000000013FAF0000-memory.dmp

Filesize
896KB

Download
memory/952-2-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/952-3-0x00000000001A0000-0x00000000001BC000-memory.dmp

Filesize
112KB

Download
memory/952-4-0x0000000000160000-0x0000000000174000-memory.dmp

Filesize
80KB

Download
memory/952-5-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/952-23-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2540-14-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/2540-20-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2592-22-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads