ba5cf0e14767afbaf1ef4310a5a7a55e152b7c54507a1b567133cdf42493629d

General

Target
Message body Contents.pdf.exe
Size 961KB
Sample201019-3s111lmdjs
SHA256 ba5cf0e14767afbaf1ef4310a5a7a55e152b7c54507a1b567133cdf42493629d
MD5 1ab84609d5d1f291b178f14645923518
SHA1 91eb8fdb42f3fe24c80679629ec88b1913028cd0
SHA512 6d3df4393b29a1ccdbb5b25f002c3f17c788ade7d9d5fc2088baeed20758b318293efa923702cb1e981e9be152152d3a0a985fd7e8a34cfc8917bb2f4ffc21e6
MD5 SHA1 SHA512

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Message body Contents.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Message body Contents.pdf.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Message body Contents.pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Message body Contents.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 2764	3888	Message body Contents.pdf.exe	79

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3888	Message body Contents.pdf.exe
2764	Message body Contents.pdf.exe
2764	Message body Contents.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	Message body Contents.pdf.exe
Token: SeDebugPrivilege	2764	Message body Contents.pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2144	3888	Message body Contents.pdf.exe	77
PID 3888 wrote to memory of 2144	3888	Message body Contents.pdf.exe	77
PID 3888 wrote to memory of 2144	3888	Message body Contents.pdf.exe	77
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79
PID 3888 wrote to memory of 2764	3888	Message body Contents.pdf.exe	79

C:\Users\Admin\AppData\Local\Temp\Message body Contents.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Message body Contents.pdf.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pdNWurRz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D1C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\Message body Contents.pdf.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764