e4ae2cb5ba91a9b7a87cb5d79158e07f8252e8c3ad0649fca573a0d73bbbdc62

General

Target
inv-img.pdf.exe
Size 101KB
Sample201012-b3ghv2th4n
SHA256 e4ae2cb5ba91a9b7a87cb5d79158e07f8252e8c3ad0649fca573a0d73bbbdc62
MD5 17d6fb7249d7cf29404e4b604f38a35c
SHA1 8660283f1dd38d08004390b5729603ff11b0d842
SHA512 08b8731489920c0fc2042251a7391ee200eb761c33c836f2e3759ca8ec4d389f589790931a675633622b561b4878a5e248af999f18e46ba7ef4fa0044ff95c7d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1444	image5585jp.jpg
1624	image5585jp.jpg

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!clear-cache = "cmd /c powershell Start-Process -FilePath 'C:\\Users\\Admin\\AppData\\Local\\Temp\\lang965p.jpg' d -RedirectStandardError c:\\ps\\_pseror.txt"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1624	1444	image5585jp.jpg	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1624	WerFault.exe	79

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2152	timeout.exe
2836	timeout.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3320	2928	inv-img.pdf.exe	74
PID 2928 wrote to memory of 3320	2928	inv-img.pdf.exe	74
PID 2928 wrote to memory of 3320	2928	inv-img.pdf.exe	74
PID 2928 wrote to memory of 1444	2928	inv-img.pdf.exe	78
PID 2928 wrote to memory of 1444	2928	inv-img.pdf.exe	78
PID 2928 wrote to memory of 1444	2928	inv-img.pdf.exe	78
PID 1444 wrote to memory of 1624	1444	image5585jp.jpg	79
PID 1444 wrote to memory of 1624	1444	image5585jp.jpg	79
PID 1444 wrote to memory of 1624	1444	image5585jp.jpg	79
PID 1444 wrote to memory of 1624	1444	image5585jp.jpg	79
PID 1444 wrote to memory of 1756	1444	image5585jp.jpg	80
PID 1444 wrote to memory of 1756	1444	image5585jp.jpg	80
PID 1444 wrote to memory of 1756	1444	image5585jp.jpg	80
PID 2928 wrote to memory of 1644	2928	inv-img.pdf.exe	82
PID 2928 wrote to memory of 1644	2928	inv-img.pdf.exe	82
PID 2928 wrote to memory of 1644	2928	inv-img.pdf.exe	82
PID 1756 wrote to memory of 2152	1756	cmd.exe	83
PID 1756 wrote to memory of 2152	1756	cmd.exe	83
PID 1756 wrote to memory of 2152	1756	cmd.exe	83
PID 2928 wrote to memory of 2660	2928	inv-img.pdf.exe	85
PID 2928 wrote to memory of 2660	2928	inv-img.pdf.exe	85
PID 2928 wrote to memory of 2660	2928	inv-img.pdf.exe	85
PID 2660 wrote to memory of 2836	2660	cmd.exe	86
PID 2660 wrote to memory of 2836	2660	cmd.exe	86
PID 2660 wrote to memory of 2836	2660	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\inv-img.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\inv-img.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v !clear-cache /f /d "cmd /c powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\lang965p.jpg' d -RedirectStandardError c:\ps\_pseror.txt"
  2⤵
  - Adds Run key to start application
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg
  "C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg
    "C:\Users\Admin\AppData\Local\Temp\image5585jp.jpg"
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 104
      4⤵
      Program crash
      PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\me.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10
      4⤵
      Delays execution with timeout.exe
      PID:2152
- C:\Windows\SysWOW64\REG.exe
  REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v !clear-cache /f
  2⤵
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\me.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-12-0x0000000005040000-0x0000000005041000-memory.dmp

Download

Analysis

Sharing