Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
30-06-2020 12:28
Static task
static1
Behavioral task
behavioral1
Sample
Futuroso New Order Pdf.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Futuroso New Order Pdf.exe
Resource
win10
General
-
Target
Futuroso New Order Pdf.exe
-
Size
305KB
-
MD5
a7d90dca0ef0e9ee58de4a29c51f1a5b
-
SHA1
a06f5368a04d83e45b2a42ffefc0c90fbb1a8739
-
SHA256
9f53e0ba2145f3e5c599392f4420513df545be0f4a5034310eb149672d5c44e5
-
SHA512
36bb1951cbcd7eed4daafb87569e51078fbbc21b1cde8cb15adbc0efa36be376a2204234398b797f292714651c7498bdee5552ac8965ef6a5cd7eba95ccc6c02
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Futuroso New Order Pdf.exechkdsk.exepid process 1820 Futuroso New Order Pdf.exe 1820 Futuroso New Order Pdf.exe 1820 Futuroso New Order Pdf.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Vqdil0ti\certmgr8pbx.exe chkdsk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Futuroso New Order Pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1092 wrote to memory of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1192 wrote to memory of 1728 1192 Explorer.EXE chkdsk.exe PID 1192 wrote to memory of 1728 1192 Explorer.EXE chkdsk.exe PID 1192 wrote to memory of 1728 1192 Explorer.EXE chkdsk.exe PID 1192 wrote to memory of 1728 1192 Explorer.EXE chkdsk.exe PID 1728 wrote to memory of 1804 1728 chkdsk.exe cmd.exe PID 1728 wrote to memory of 1804 1728 chkdsk.exe cmd.exe PID 1728 wrote to memory of 1804 1728 chkdsk.exe cmd.exe PID 1728 wrote to memory of 1804 1728 chkdsk.exe cmd.exe PID 1728 wrote to memory of 1568 1728 chkdsk.exe Firefox.exe PID 1728 wrote to memory of 1568 1728 chkdsk.exe Firefox.exe PID 1728 wrote to memory of 1568 1728 chkdsk.exe Firefox.exe PID 1728 wrote to memory of 1568 1728 chkdsk.exe Firefox.exe PID 1728 wrote to memory of 1568 1728 chkdsk.exe Firefox.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Futuroso New Order Pdf.exechkdsk.exepid process 1820 Futuroso New Order Pdf.exe 1820 Futuroso New Order Pdf.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe 1728 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Futuroso New Order Pdf.exeFuturoso New Order Pdf.exechkdsk.exedescription pid process target process PID 1092 set thread context of 1820 1092 Futuroso New Order Pdf.exe Futuroso New Order Pdf.exe PID 1820 set thread context of 1192 1820 Futuroso New Order Pdf.exe Explorer.EXE PID 1728 set thread context of 1192 1728 chkdsk.exe Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1804 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Futuroso New Order Pdf.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1820 Futuroso New Order Pdf.exe Token: SeDebugPrivilege 1728 chkdsk.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HX4XDXN0V = "C:\\Program Files (x86)\\Vqdil0ti\\certmgr8pbx.exe" chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\Futuroso New Order Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Futuroso New Order Pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Futuroso New Order Pdf.exe"{path}"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Futuroso New Order Pdf.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\0M32P791\0M3logim.jpeg
-
C:\Users\Admin\AppData\Roaming\0M32P791\0M3logrf.ini
-
C:\Users\Admin\AppData\Roaming\0M32P791\0M3logri.ini
-
C:\Users\Admin\AppData\Roaming\0M32P791\0M3logrv.ini
-
memory/1092-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1568-11-0x0000000000000000-mapping.dmp
-
memory/1568-12-0x000000013FDA0000-0x000000013FE33000-memory.dmpFilesize
588KB
-
memory/1728-5-0x0000000000A60000-0x0000000000A67000-memory.dmpFilesize
28KB
-
memory/1728-9-0x0000000075DB0000-0x0000000075ECD000-memory.dmpFilesize
1.1MB
-
memory/1728-10-0x00000000039C0000-0x0000000003B4F000-memory.dmpFilesize
1.6MB
-
memory/1728-8-0x0000000075850000-0x000000007585C000-memory.dmpFilesize
48KB
-
memory/1728-7-0x0000000001E70000-0x0000000001FB7000-memory.dmpFilesize
1.3MB
-
memory/1728-4-0x0000000000000000-mapping.dmp
-
memory/1804-6-0x0000000000000000-mapping.dmp
-
memory/1820-3-0x000000000041E2D0-mapping.dmp
-
memory/1820-2-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB