Analysis
- max time kernel
118s - max time network
126s - platform
windows10_x64 - resource
win10 - submitted
05/08/2020, 12:10
General
- Target Purchase Order 480211- CVE8112.PDF.exe
- Size 380KB
- Sample200805-w4qcdvneps
- SHA256 bc7fb2af77215f36ed3e06ffa0082540b39038ec8f85df98a48879d9d942862b
Score
10/10
Malware Config
Signatures
- Program crash 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 480211- CVE8112.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 480211- CVE8112.PDF.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Checks whether UAC is enabled
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 5842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 6562⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4016-0-0x0000000000A01000-0x0000000000A02000-memory.dmp
memory/4016-1-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/4016-5-0x00000000028B0000-0x00000000028B1000-memory.dmp