25f49f7e6a95a52bd15fb0ab81e5d53b5753d813a14edac8eccaa5bbba4cf57b

General

Target
PO1228pdf.exe
Size 835KB
Sample201227-brg5cpcsp2
SHA256 25f49f7e6a95a52bd15fb0ab81e5d53b5753d813a14edac8eccaa5bbba4cf57b
MD5 62a8be0ead7b60bceb7df308a672baf2
SHA1 f34a522f70b663ab49be89616ad62e864b3199ae
SHA512 7581ccb0b17bb31ef205049a329a2802e8ae034e77408a315eb73d6a3fea89a5dbda1acc08ba3c2067591424c8c5f389fcb9d2822f5bf994f13dc0ddff936e48
MD5 SHA1 SHA512

Score

9^/10

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PO1228pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PO1228pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\pBIYNM = "C:\\Users\\Admin\\AppData\\Roaming\\pBIYNM\\pBIYNM.exe"	PO1228pdf.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	PO1228pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	PO1228pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4300	4648	PO1228pdf.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	PO1228pdf.exe
Token: SeDebugPrivilege	4300	PO1228pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3524	4648	PO1228pdf.exe	79
PID 4648 wrote to memory of 3524	4648	PO1228pdf.exe	79
PID 4648 wrote to memory of 3524	4648	PO1228pdf.exe	79
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81
PID 4648 wrote to memory of 4300	4648	PO1228pdf.exe	81

C:\Users\Admin\AppData\Local\Temp\PO1228pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO1228pdf.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hWYaBusmUKG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C1B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\PO1228pdf.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300