Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 20:15
Static task
static1
Behavioral task
behavioral1
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
FedexTrackingClearanceInformation_PDF.exe
-
Size
2.1MB
-
MD5
49ed9fd1bfe4e4d685f014084d3b11b4
-
SHA1
ad9aa4dedddcd8de2d2fab04344d8f26c165537d
-
SHA256
f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
-
SHA512
b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfrbuild.exedescription pid process target process PID 1948 set thread context of 1996 1948 lfrbuild.exe AddInProcess32.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\rflbuild = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\lfrbuild.exe" reg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1768 FedexTrackingClearanceInformation_PDF.exe Token: SeDebugPrivilege 1948 lfrbuild.exe Token: SeDebugPrivilege 1996 AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exepid process 1768 FedexTrackingClearanceInformation_PDF.exe 1768 FedexTrackingClearanceInformation_PDF.exe 1768 FedexTrackingClearanceInformation_PDF.exe 1948 lfrbuild.exe 1948 lfrbuild.exe 1948 lfrbuild.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.execmd.exelfrbuild.exedescription pid process target process PID 1768 wrote to memory of 1868 1768 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1768 wrote to memory of 1868 1768 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1768 wrote to memory of 1868 1768 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1768 wrote to memory of 1868 1768 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1868 wrote to memory of 1880 1868 cmd.exe reg.exe PID 1868 wrote to memory of 1880 1868 cmd.exe reg.exe PID 1868 wrote to memory of 1880 1868 cmd.exe reg.exe PID 1868 wrote to memory of 1880 1868 cmd.exe reg.exe PID 1768 wrote to memory of 1948 1768 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1768 wrote to memory of 1948 1768 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1768 wrote to memory of 1948 1768 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1768 wrote to memory of 1948 1768 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe PID 1948 wrote to memory of 1996 1948 lfrbuild.exe AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exepid process 1768 FedexTrackingClearanceInformation_PDF.exe 1948 lfrbuild.exe -
Executes dropped EXE 2 IoCs
Processes:
lfrbuild.exeAddInProcess32.exepid process 1948 lfrbuild.exe 1996 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"3⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exe"C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exe
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exe
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
\Users\Admin\AppData\Roaming\lfrbuild.exe
-
memory/1768-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1868-3-0x0000000000000000-mapping.dmp
-
memory/1880-4-0x0000000000000000-mapping.dmp
-
memory/1948-6-0x0000000000000000-mapping.dmp
-
memory/1996-17-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1996-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1996-15-0x000000000040C75E-mapping.dmp
-
memory/1996-18-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB