Overview

overview

8

Static

static

LIST OF ITEMS.pdf.exe

windows7_x64

8

LIST OF ITEMS.pdf.exe

windows10_x64

8

Analysis

  • max time kernel
    19s
  • max time network
    70s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13/11/2020, 08:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LIST OF ITEMS.pdf.exe
  • Size 1.2MB
  • Sample201113-vctrb43w42
  • SHA256 4a2d48d163b550561583e4e5811dc43cb67045e7a9816c30fb8fde4af8dd06d5
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LIST OF ITEMS.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\LIST OF ITEMS.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/LIST OF ITEMS.pdf.exe" "%appdata%\FolderN\name.exe" /Y
      2⤵
        PID:1528
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\name.exe.lnk" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f
          3⤵
            PID:3120
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\name.exe:Zone.Identifier
          2⤵
          • NTFS ADS
          PID:2124
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\name.exe.jpg" name.exe
          2⤵
            PID:1152
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3892
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 300
              3⤵
              • Delays execution with timeout.exe
              PID:3940

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              memory/2016-8-0x0000000000400000-0x00000000004F3000-memory.dmp
              Download

              memory/2016-4-0x0000000000400000-0x00000000004F3000-memory.dmp
              Download

              memory/3092-0-0x0000000073A30000-0x000000007411E000-memory.dmp
              Download

              memory/3092-3-0x0000000005680000-0x0000000005681000-memory.dmp
              Download

              memory/3092-1-0x0000000000B80000-0x0000000000B81000-memory.dmp
              Download