Analysis
- max time kernel
119s - max time network
118s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
LIST OF ITEMS.pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
LIST OF ITEMS.pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target LIST OF ITEMS.pdf.exe
- Size 1.2MB
- Sample201113-vctrb43w42
- SHA256 4a2d48d163b550561583e4e5811dc43cb67045e7a9816c30fb8fde4af8dd06d5
- MD5 60bc40739d2169adcba60fa60d7d1414
- SHA1 75ea44abe2a800467d09b11a89967d90b416b97d
- SHA512 f193a6ec9749406582be0225361d72574adda07c8cdff8822d1f153f3fed3394bcbf7f5268c9943d3bd4e95e14c39c239ef022f868d5f7b85bd13778affc0914
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 908 svhost.exe - Loads dropped DLL 2 IoCs
pid Process 536 LIST OF ITEMS.pdf.exe 536 LIST OF ITEMS.pdf.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 536 set thread context of 908 536 LIST OF ITEMS.pdf.exe 29 - Delays execution with timeout.exe 1 IoCs
pid Process 1056 timeout.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 536 LIST OF ITEMS.pdf.exe 536 LIST OF ITEMS.pdf.exe 536 LIST OF ITEMS.pdf.exe 536 LIST OF ITEMS.pdf.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 536 LIST OF ITEMS.pdf.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 908 536 LIST OF ITEMS.pdf.exe 29 PID 536 wrote to memory of 1640 536 LIST OF ITEMS.pdf.exe 30 PID 536 wrote to memory of 1640 536 LIST OF ITEMS.pdf.exe 30 PID 536 wrote to memory of 1640 536 LIST OF ITEMS.pdf.exe 30 PID 536 wrote to memory of 1640 536 LIST OF ITEMS.pdf.exe 30 PID 536 wrote to memory of 1672 536 LIST OF ITEMS.pdf.exe 32 PID 536 wrote to memory of 1672 536 LIST OF ITEMS.pdf.exe 32 PID 536 wrote to memory of 1672 536 LIST OF ITEMS.pdf.exe 32 PID 536 wrote to memory of 1672 536 LIST OF ITEMS.pdf.exe 32 PID 1672 wrote to memory of 1744 1672 cmd.exe 34 PID 1672 wrote to memory of 1744 1672 cmd.exe 34 PID 1672 wrote to memory of 1744 1672 cmd.exe 34 PID 1672 wrote to memory of 1744 1672 cmd.exe 34 PID 536 wrote to memory of 1008 536 LIST OF ITEMS.pdf.exe 35 PID 536 wrote to memory of 1008 536 LIST OF ITEMS.pdf.exe 35 PID 536 wrote to memory of 1008 536 LIST OF ITEMS.pdf.exe 35 PID 536 wrote to memory of 1008 536 LIST OF ITEMS.pdf.exe 35 PID 536 wrote to memory of 876 536 LIST OF ITEMS.pdf.exe 37 PID 536 wrote to memory of 876 536 LIST OF ITEMS.pdf.exe 37 PID 536 wrote to memory of 876 536 LIST OF ITEMS.pdf.exe 37 PID 536 wrote to memory of 876 536 LIST OF ITEMS.pdf.exe 37 PID 536 wrote to memory of 552 536 LIST OF ITEMS.pdf.exe 39 PID 536 wrote to memory of 552 536 LIST OF ITEMS.pdf.exe 39 PID 536 wrote to memory of 552 536 LIST OF ITEMS.pdf.exe 39 PID 536 wrote to memory of 552 536 LIST OF ITEMS.pdf.exe 39 PID 552 wrote to memory of 1056 552 cmd.exe 41 PID 552 wrote to memory of 1056 552 cmd.exe 41 PID 552 wrote to memory of 1056 552 cmd.exe 41 PID 552 wrote to memory of 1056 552 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\LIST OF ITEMS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\LIST OF ITEMS.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/LIST OF ITEMS.pdf.exe" "%appdata%\FolderN\name.exe" /Y2⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f3⤵PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
PID:1008
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\name.exe.jpg" name.exe2⤵PID:876
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:1056
-
-