Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
10-07-2020 09:17
Static task
static1
Behavioral task
behavioral1
Sample
quotation List #039.pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
quotation List #039.pdf.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
quotation List #039.pdf.exe
-
Size
325KB
-
MD5
2b1b6a99d9427ced3bcaaf141dd36b34
-
SHA1
43e55e4c97dd72e3186e1849242f3cd62d991bd6
-
SHA256
36f76be816898a8ac90603edeed2ff90983d062f047f6e00c66d54964c582cc8
-
SHA512
1b73afad027bf565e0e4007ee5c6d0cd5b2420182c4de7179dcef7f7f91789aabab8a2b4efd17a5cd50432c3598ced5058130104daa57d9f0f8b71c4fd41b1fa
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1628 quotation List #039.pdf.exe 1628 quotation List #039.pdf.exe 1628 quotation List #039.pdf.exe 1628 quotation List #039.pdf.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe 1568 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1628 quotation List #039.pdf.exe 1628 quotation List #039.pdf.exe 1628 quotation List #039.pdf.exe 1568 msdt.exe 1568 msdt.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2952 wrote to memory of 1568 2952 Explorer.EXE 69 PID 2952 wrote to memory of 1568 2952 Explorer.EXE 69 PID 2952 wrote to memory of 1568 2952 Explorer.EXE 69 PID 1568 wrote to memory of 2768 1568 msdt.exe 72 PID 1568 wrote to memory of 2768 1568 msdt.exe 72 PID 1568 wrote to memory of 2768 1568 msdt.exe 72 PID 1568 wrote to memory of 4044 1568 msdt.exe 75 PID 1568 wrote to memory of 4044 1568 msdt.exe 75 PID 1568 wrote to memory of 4044 1568 msdt.exe 75 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1628 quotation List #039.pdf.exe Token: SeDebugPrivilege 1568 msdt.exe Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1628 set thread context of 2952 1628 quotation List #039.pdf.exe 56 PID 1568 set thread context of 2952 1568 msdt.exe 56 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gsdo01nm\helpzz7hz.exe msdt.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KX2XJPSHO = "C:\\Program Files (x86)\\Gsdo01nm\\helpzz7hz.exe" msdt.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\quotation List #039.pdf.exe"C:\Users\Admin\AppData\Local\Temp\quotation List #039.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1628
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Adds Run entry to start application
PID:1568 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\quotation List #039.pdf.exe"3⤵PID:2768
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:4044
-
-