Analysis
-
max time kernel
3s -
max time network
4s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 10:07
Static task
static1
Behavioral task
behavioral1
Sample
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe
Resource
win10v20201028
General
-
Target
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe
-
Size
1.8MB
-
MD5
5b2c784d7de1aeb2bbfcee269f138e00
-
SHA1
9948f3bf9aa8c548139c2b6c969cb90b9ace4c3a
-
SHA256
cb8642988cadd0d704adcd1025d24a0604416c9fbd92d9b74597e861c0a15d22
-
SHA512
0eaacc0d76a93db04a0ed55878fa90d30b48debe23ff0a38dcc223d1daada1f53da558b1bfec052af04e9fdffcf0b979fa18309d2dd1954ff934f6491ed4e1cb
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe -
Processes:
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe = "0" imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe" imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exedescription pid process target process PID 3888 wrote to memory of 3928 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe PID 3888 wrote to memory of 3928 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe PID 3888 wrote to memory of 3928 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe PID 3888 wrote to memory of 2588 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe PID 3888 wrote to memory of 2588 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe PID 3888 wrote to memory of 2588 3888 imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe"C:\Users\Admin\AppData\Local\Temp\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe"1⤵
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe" -Force2⤵PID:3928
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe" -Force2⤵PID:2588
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe" -Force2⤵PID:2568
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\imagnpdf0440690129912239vistaprevia02052329503adobeplayer02304293.exe" -Force2⤵PID:2736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2568-16-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/2568-12-0x0000000000000000-mapping.dmp
-
memory/2588-11-0x0000000000000000-mapping.dmp
-
memory/2588-17-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/2736-22-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/2736-13-0x0000000000000000-mapping.dmp
-
memory/3888-8-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/3888-6-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3888-9-0x00000000050C0000-0x00000000050FE000-memory.dmpFilesize
248KB
-
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3888-7-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/3888-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/3888-5-0x0000000005A40000-0x0000000005A41000-memory.dmpFilesize
4KB
-
memory/3928-10-0x0000000000000000-mapping.dmp
-
memory/3928-15-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3928-18-0x0000000006F00000-0x0000000006F01000-memory.dmpFilesize
4KB
-
memory/3928-14-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3928-26-0x0000000006E50000-0x0000000006E51000-memory.dmpFilesize
4KB
-
memory/3928-27-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/3928-29-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/3928-31-0x0000000007880000-0x0000000007881000-memory.dmpFilesize
4KB