Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.845513575891335
Filename:	invoice.exe
Filesize:	1262619
MD5:	6af6a7fac1197a9b12b28c0e4db8c18a
SHA1:	357ae7d706de393d8743dbbe0d94bc87922643cf
SHA256:	d0a2035c0431796c138a26d1c9a75142b613c5417dc96a9200723870d0b3a687
SHA512:	6a89fbff98be91a89008830f7aa3f88ef8fcd4c9967d1443abda4bad71097f6abc6a1371e0767e8853a3e52bd4e3f944f4ccbb7f8173d06d7c777bc71823f899
SSDEEP:	24576:2TbBv5rUyXVTW6Hq69NuPQPyUfezTtJiC7nVUriVGAQ+hw17tq:IBJTzHqBQrW3tEwnGtdCOBq
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
File is packed with WinRar	Data Obfuscation	Software Packing
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Checks the free space of harddrives	Malware Analysis System Evasion	System Information Discovery
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Executes batch files	System Summary	Scripting
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\ProgramData\HostData\logs.uce
Category:	dropped
Dump:	logs.uce.16.dr
ID:	dr_15
Target ID:	16
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.7081731137089875
Encrypted:	false
Size:	345
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

File:	C:\Users\user\AppData\Local\Temp\RarSFX0\4usfliof.exe
Category:	dropped
Dump:	4usfliof.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\invoice.exe
Type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	1.0341658078917435
Encrypted:	false
Size:	3555328
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for dropped file	AV Detection	Security Software Discovery
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

Details

File:	C:\Users\user\AppData\Local\Temp\RarSFX0\yee9mbi69cm7.exe
Category:	dropped
Dump:	yee9mbi69cm7.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\invoice.exe
Type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	4.279748667922797
Encrypted:	false
Size:	6004224
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Multi AV Scanner detection for dropped file	AV Detection	Security Software Discovery
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

Details

File:	C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Category:	dropped
Dump:	qmgr.db.28.dr
ID:	dr_16
Target ID:	28
Process:	C:\Windows\System32\svchost.exe
Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe22c1279, page size 16384, DirtyShutdown, Windows version 10.0
Entropy:	0.5144834292845957
Encrypted:	false
Size:	1310720
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_4usfliof.exe_a3d47586b2c69266b12d8e2b19c3534f9227641_387adc58_868073ac-51a0-4917-9916-aa69f0fa1e47\Report.wer
Category:	dropped
Dump:	Report.wer.10.dr
ID:	dr_4
Target ID:	10
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.7278065367498975
Encrypted:	false
Size:	65536
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yee9mbi69cm7.exe_6fddb4b4b7c58a1de7975d74ffa3f4d605395ef_b588fa24_8853fd16-c8fc-4d73-89e1-f78d31385c18\Report.wer
Category:	dropped
Dump:	Report.wer.15.dr
ID:	dr_13
Target ID:	15
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.7329914923670381
Encrypted:	false
Size:	65536
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER18E8.tmp.dmp
Category:	dropped
Dump:	WER18E8.tmp.dmp.10.dr
ID:	dr_6
Target ID:	10
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Fri May 3 12:35:31 2024, 0x1205a4 type
Entropy:	1.7173551139441021
Encrypted:	false
Size:	41526
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER1946.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER1946.tmp.WERInternalMetadata.xml.10.dr
ID:	dr_7
Target ID:	10
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7203888327678136
Encrypted:	false
Size:	6374
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER1976.tmp.xml
Category:	dropped
Dump:	WER1976.tmp.xml.10.dr
ID:	dr_8
Target ID:	10
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.469871074867653
Encrypted:	false
Size:	4710
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FDD.tmp.dmp
Category:	dropped
Dump:	WER1FDD.tmp.dmp.15.dr
ID:	dr_10
Target ID:	15
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Fri May 3 12:35:33 2024, 0x1205a4 type
Entropy:	1.77000740406693
Encrypted:	false
Size:	40862
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER203C.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER203C.tmp.WERInternalMetadata.xml.15.dr
ID:	dr_11
Target ID:	15
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.721744108349152
Encrypted:	false
Size:	6402
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER205C.tmp.xml
Category:	dropped
Dump:	WER205C.tmp.xml.15.dr
ID:	dr_12
Target ID:	15
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.475128949980599
Encrypted:	false
Size:	4730
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\RarSFX0\Setup.bat
Category:	dropped
Dump:	Setup.bat.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\invoice.exe
Type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy:	4.343204656270956
Encrypted:	false
Size:	85
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Executes batch files	System Summary	Scripting
Spawns processes	System Summary	Process Injection

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpvf0cf2.yov.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_zpvf0cf2.yov.psm1.19.dr
ID:	dr_14
Target ID:	19
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Size:	60
Whitelisted:	false

Details

File:	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Category:	dropped
Dump:	Download-1.tmp.28.dr
ID:	dr_17
Target ID:	28
Process:	C:\Windows\System32\svchost.exe
Type:	JSON data
Entropy:	4.306461250274409
Encrypted:	false
Size:	55
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.10.dr
ID:	dr_5
Target ID:	10
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.531431349485651
Encrypted:	false
Size:	1835008
Whitelisted:	false

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.12.dr
ID:	dr_9
Target ID:	12
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Type:	ASCII text, with no line terminators
Entropy:	2.1709505944546685
Encrypted:	false
Size:	10
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
invoice.exe

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportinvoice.exe

Files

Domains

IPs

IOC Report
invoice.exe