Overview

overview

10

Static

static

3

INVOICE -...78.exe

windows7-x64

8

INVOICE -...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 12:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INVOICE - MV CNC BANGKOK - ST24PJ-278.exe

  • Size

    608KB

  • MD5

    0559acbaacfcf93cefd8bcbfd498bfe4

  • SHA1

    26142b0abd1848a4aeb96e63ed74836e5af67823

  • SHA256

    251f9b9b5d35ad3ca96da825cea2a7b95f97872a5c6994a9123e203d41093a87

  • SHA512

    e6ca8522526fcd0875d97ee1a77bcc3d11e78c6b72d7c2332331c59daae2bc2adb32ce6c803ebdaa27d4990575688acc09c6cca09664d419353f6f3ee848bcdd

  • SSDEEP

    12288:yEJwtNcDfRDyLA7sGpEBVgWd/3cN1h89cdQpNIcaiwLjnp+YDj:lHfROLIsGUVD1cTh89BZaiQ7x/

Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
      "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
      2⤵
        PID:2696
      • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
        "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
        2⤵
          PID:2860
        • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
          "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
          2⤵
            PID:2636
          • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
            "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
            2⤵
              PID:2632
            • C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
              "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"
              2⤵
                PID:2608

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Discovery

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1992-0-0x000000007493E000-0x000000007493F000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1992-1-0x00000000003A0000-0x000000000043E000-memory.dmp
              Filesize

              632KB

              Download
            • memory/1992-2-0x0000000074930000-0x000000007501E000-memory.dmp
              Filesize

              6.9MB

              Download
            • memory/1992-3-0x0000000000440000-0x0000000000450000-memory.dmp
              Filesize

              64KB

              Download
            • memory/1992-4-0x0000000000880000-0x000000000088C000-memory.dmp
              Filesize

              48KB

              Download
            • memory/1992-5-0x0000000001F70000-0x0000000001FE6000-memory.dmp
              Filesize

              472KB

              Download
            • memory/1992-6-0x0000000074930000-0x000000007501E000-memory.dmp
              Filesize

              6.9MB

              Download