Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v200430 - submitted
13/07/2020, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
MV EVER DIADEM YOY 149E_pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MV EVER DIADEM YOY 149E_pdf.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target MV EVER DIADEM YOY 149E_pdf.exe
- Size 935KB
- Sample200713-hp322nmb8s
- SHA256 336024c1299d7903a83d3dc3f1575349d747c883fcfd29d014931c3887101c45
- MD5 14e3a0848d049b549462fe90f204e0a2
- SHA1 42272a41052942331ee7c8409c008cc63aacd14a
- SHA512 b4e9bbe4722791175270766a48a0e67dd1298eb98cf3b5af5839aee0cba4cd0b101ea959bec247cb0114a5c83e209f4e68b03544072774f601f73655f38dff7e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1492 MV EVER DIADEM YOY 149E_pdf.exe 1492 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1664 1492 MV EVER DIADEM YOY 149E_pdf.exe 68 PID 1492 wrote to memory of 1664 1492 MV EVER DIADEM YOY 149E_pdf.exe 68 PID 1492 wrote to memory of 1664 1492 MV EVER DIADEM YOY 149E_pdf.exe 68 PID 3012 wrote to memory of 1808 3012 Explorer.EXE 69 PID 3012 wrote to memory of 1808 3012 Explorer.EXE 69 PID 3012 wrote to memory of 1808 3012 Explorer.EXE 69 PID 1808 wrote to memory of 2120 1808 explorer.exe 70 PID 1808 wrote to memory of 2120 1808 explorer.exe 70 PID 1808 wrote to memory of 2120 1808 explorer.exe 70 PID 1808 wrote to memory of 3024 1808 explorer.exe 76 PID 1808 wrote to memory of 3024 1808 explorer.exe 76 PID 1808 wrote to memory of 3024 1808 explorer.exe 76 PID 1808 wrote to memory of 3912 1808 explorer.exe 78 PID 1808 wrote to memory of 3912 1808 explorer.exe 78 PID 1808 wrote to memory of 3912 1808 explorer.exe 78 - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1492 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1664 MV EVER DIADEM YOY 149E_pdf.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1492 set thread context of 1664 1492 MV EVER DIADEM YOY 149E_pdf.exe 68 PID 1664 set thread context of 3012 1664 MV EVER DIADEM YOY 149E_pdf.exe 56 PID 1808 set thread context of 3012 1808 explorer.exe 56 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer explorer.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1664 MV EVER DIADEM YOY 149E_pdf.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\P6lwtzv\rv4h9h6xdcf.exe explorer.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MBCTUFW = "C:\\Program Files (x86)\\P6lwtzv\\rv4h9h6xdcf.exe" explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\MV EVER DIADEM YOY 149E_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV EVER DIADEM YOY 149E_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\MV EVER DIADEM YOY 149E_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV EVER DIADEM YOY 149E_pdf.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- System policy modification
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Adds Run entry to policy start application
PID:1808 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MV EVER DIADEM YOY 149E_pdf.exe"3⤵PID:2120
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3024
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3912
-
-