6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42

General

Target
Investment document.exe
Size 579KB
Sample200812-72h26eb4v6
SHA256 6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42
MD5 acdbfe43f4840b7eb031173fcda1ae6b
SHA1 787e577a5c28a4d1799439a5778c444c28e614fc
SHA512 2c93762e3ee13e385185bab2b78a9d1d6e7f37fabe7f187ca712d407ecb626337e380ce5885cf85baf78dfc0ff4d39cef619b381ee00f3a4be9d1073838a0b53
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Investment document.exe"	Investment document.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	Investment document.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	Investment document.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\kmuDxAt = "0"	Investment document.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	Investment document.exe
File opened for modification	C:\Windows\System32\rfxvmt.dll	Investment document.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 4076	3900	Investment document.exe	75

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	Investment document.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	Investment document.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4076	Investment document.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3052	3900	Investment document.exe	72
PID 3900 wrote to memory of 3052	3900	Investment document.exe	72
PID 3900 wrote to memory of 3052	3900	Investment document.exe	72
PID 3900 wrote to memory of 4040	3900	Investment document.exe	74
PID 3900 wrote to memory of 4040	3900	Investment document.exe	74
PID 3900 wrote to memory of 4040	3900	Investment document.exe	74
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75
PID 3900 wrote to memory of 4076	3900	Investment document.exe	75

C:\Users\Admin\AppData\Local\Temp\Investment document.exe
"C:\Users\Admin\AppData\Local\Temp\Investment document.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JHswPmZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5941.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Investment document.exe
  "C:\Users\Admin\AppData\Local\Temp\Investment document.exe"
  2⤵
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\Investment document.exe
  "C:\Users\Admin\AppData\Local\Temp\Investment document.exe"
  2⤵
  - Adds Run key to start application
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:4076