e4ae2cb5ba91a9b7a87cb5d79158e07f8252e8c3ad0649fca573a0d73bbbdc62

Analysis

max time kernel
23s
max time network
11s
platform
windows7_x64
resource
win7v200722
submitted
12/10/2020, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inv-img.pdf.exe
Size 101KB
Sample201012-b3ghv2th4n
SHA256 e4ae2cb5ba91a9b7a87cb5d79158e07f8252e8c3ad0649fca573a0d73bbbdc62
MD5 17d6fb7249d7cf29404e4b604f38a35c
SHA1 8660283f1dd38d08004390b5729603ff11b0d842
SHA512 08b8731489920c0fc2042251a7391ee200eb761c33c836f2e3759ca8ec4d389f589790931a675633622b561b4878a5e248af999f18e46ba7ef4fa0044ff95c7d
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1964	image5585jp.jpg
1988	image5585jp.jpg

Deletes itself 1 IoCs

pid	Process
268	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
848	inv-img.pdf.exe
1964	image5585jp.jpg

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!clear-cache = "cmd /c powershell Start-Process -FilePath 'C:\\Users\\Admin\\AppData\\Local\\Temp\\lang965p.jpg' d -RedirectStandardError c:\\ps\\_pseror.txt"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1988	1964	image5585jp.jpg	33

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1548	timeout.exe
1376	timeout.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1052	848	inv-img.pdf.exe	26
PID 848 wrote to memory of 1052	848	inv-img.pdf.exe	26
PID 848 wrote to memory of 1052	848	inv-img.pdf.exe	26
PID 848 wrote to memory of 1052	848	inv-img.pdf.exe	26
PID 848 wrote to memory of 1964	848	inv-img.pdf.exe	32
PID 848 wrote to memory of 1964	848	inv-img.pdf.exe	32
PID 848 wrote to memory of 1964	848	inv-img.pdf.exe	32
PID 848 wrote to memory of 1964	848	inv-img.pdf.exe	32
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 1988	1964	image5585jp.jpg	33
PID 1964 wrote to memory of 268	1964	image5585jp.jpg	34
PID 1964 wrote to memory of 268	1964	image5585jp.jpg	34
PID 1964 wrote to memory of 268	1964	image5585jp.jpg	34
PID 1964 wrote to memory of 268	1964	image5585jp.jpg	34
PID 848 wrote to memory of 576	848	inv-img.pdf.exe	35
PID 848 wrote to memory of 576	848	inv-img.pdf.exe	35
PID 848 wrote to memory of 576	848	inv-img.pdf.exe	35
PID 848 wrote to memory of 576	848	inv-img.pdf.exe	35
PID 848 wrote to memory of 760	848	inv-img.pdf.exe	36
PID 848 wrote to memory of 760	848	inv-img.pdf.exe	36
PID 848 wrote to memory of 760	848	inv-img.pdf.exe	36
PID 848 wrote to memory of 760	848	inv-img.pdf.exe	36
PID 268 wrote to memory of 1548	268	cmd.exe	37
PID 268 wrote to memory of 1548	268	cmd.exe	37
PID 268 wrote to memory of 1548	268	cmd.exe	37
PID 268 wrote to memory of 1548	268	cmd.exe	37
PID 760 wrote to memory of 1376	760	cmd.exe	38
PID 760 wrote to memory of 1376	760	cmd.exe	38
PID 760 wrote to memory of 1376	760	cmd.exe	38
PID 760 wrote to memory of 1376	760	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\inv-img.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\inv-img.pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v !clear-cache /f /d "cmd /c powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\lang965p.jpg' d -RedirectStandardError c:\ps\_pseror.txt"
  2⤵
  - Adds Run key to start application
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg
  "C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg
    "C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg"
    3⤵
    - Executes dropped EXE
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\me.bat""
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:268
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10
      4⤵
      Delays execution with timeout.exe
      PID:1548
- C:\Windows\SysWOW64\REG.exe
  REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v !clear-cache /f
  2⤵
  PID:576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\me.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-1-0x000007FEF6690000-0x000007FEF690A000-memory.dmp

Download