Analysis
-
max time kernel
26s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 09:12
Static task
static1
Behavioral task
behavioral1
Sample
Doc_3957495686846574893974939464936488463936484,pdf.exe
Resource
win7v20201028
General
-
Target
Doc_3957495686846574893974939464936488463936484,pdf.exe
-
Size
77KB
-
MD5
1662b1ff6de1371a09ecabb5a2c14905
-
SHA1
5a9353c5b8b1e1b19b7879cd483c9f715237c478
-
SHA256
3a220e6bff537b270991d1bb49e530c7279fb643f8a9b5998bbefae6140a19f4
-
SHA512
ae20025d79fbfbf85bceeaca71fcd170966eaa71761dffc4d96405311e314f44b4f6d5573747b6923da0477c0a2ba1ecd95c14e917aa9408c157c6964fd3b68f
Malware Config
Extracted
formbook
http://www.aubonmarcheduparc.com/rina/
syndicauto.net
techvorx.com
palletrackingvancouver.com
pricetrackerindia.com
photocravings.com
jenniferlwilsonrn.com
cartucce-toner.com
fred-auto-sport.com
aletheajean.com
beautyhacks.website
seoalmaguer.com
cursoencasa.net
flex-eg.com
dygdreams.com
magnoliadawson.com
whitehouseeffectband.com
visualtrigger.art
kalinahybridseeds.com
glacesnamur.com
drbordogna.com
wealthtells.com
opaoman.xyz
ieltsjo.com
graphicoustic.com
jimboprivacy.com
blockchainclood.com
aulsgdcqg.icu
swipeonyourself.com
mccraft.club
scirispartner.com
mlinkstec.com
allungamentopene.net
quailridgeminischnauzers.com
teensatoz.com
3rud.net
921squirecourt.com
informaticas.net
unicorndragonlearning.com
duniatone.com
abmzc023.com
meteorproductions.com
pinkcouturecollection.com
dealsaction.store
kailarosales.com
maya-watches.com
ladyunivers.com
magenx2.info
3ppschool.com
panl.online
intelligenten.com
pepintre.com
safarimadeira.info
westglobalpartners.com
tamilfgun.com
upholsteredwineracks.com
superdoctormk.club
newfacesatv.info
play-morepools.com
allservice.center
ladyandpen.com
textileetobjet.com
dallasgains.com
littledeviltrainingcollar.com
liquid-metalworks.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/844-18-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral1/memory/844-19-0x000000000041D0A0-mapping.dmp xloader -
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths Doc_3957495686846574893974939464936488463936484,pdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions Doc_3957495686846574893974939464936488463936484,pdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe -
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Doc_3957495686846574893974939464936488463936484,pdf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exepid process 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription pid process target process PID 780 set thread context of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1440 780 WerFault.exe Doc_3957495686846574893974939464936488463936484,pdf.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1512 timeout.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exeDoc_3957495686846574893974939464936488463936484,pdf.exeDoc_3957495686846574893974939464936488463936484,pdf.exeWerFault.exepid process 908 powershell.exe 908 powershell.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 780 Doc_3957495686846574893974939464936488463936484,pdf.exe 844 Doc_3957495686846574893974939464936488463936484,pdf.exe 1440 WerFault.exe 1440 WerFault.exe 1440 WerFault.exe 1440 WerFault.exe 1440 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Token: SeDebugPrivilege 908 powershell.exe Token: SeDebugPrivilege 1440 WerFault.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.execmd.exedescription pid process target process PID 780 wrote to memory of 908 780 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 780 wrote to memory of 908 780 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 780 wrote to memory of 908 780 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 780 wrote to memory of 908 780 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 780 wrote to memory of 1000 780 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 780 wrote to memory of 1000 780 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 780 wrote to memory of 1000 780 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 780 wrote to memory of 1000 780 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 1000 wrote to memory of 1512 1000 cmd.exe timeout.exe PID 1000 wrote to memory of 1512 1000 cmd.exe timeout.exe PID 1000 wrote to memory of 1512 1000 cmd.exe timeout.exe PID 1000 wrote to memory of 1512 1000 cmd.exe timeout.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 844 780 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 780 wrote to memory of 1440 780 Doc_3957495686846574893974939464936488463936484,pdf.exe WerFault.exe PID 780 wrote to memory of 1440 780 Doc_3957495686846574893974939464936488463936484,pdf.exe WerFault.exe PID 780 wrote to memory of 1440 780 Doc_3957495686846574893974939464936488463936484,pdf.exe WerFault.exe PID 780 wrote to memory of 1440 780 Doc_3957495686846574893974939464936488463936484,pdf.exe WerFault.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 13202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/780-5-0x0000000004370000-0x0000000004371000-memory.dmpFilesize
4KB
-
memory/780-6-0x0000000000270000-0x000000000030B000-memory.dmpFilesize
620KB
-
memory/780-2-0x0000000073F20000-0x000000007460E000-memory.dmpFilesize
6.9MB
-
memory/844-18-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/844-23-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/844-19-0x000000000041D0A0-mapping.dmp
-
memory/908-27-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/908-33-0x00000000060F0000-0x00000000060F1000-memory.dmpFilesize
4KB
-
memory/908-12-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/908-13-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/908-14-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/908-16-0x0000000002682000-0x0000000002683000-memory.dmpFilesize
4KB
-
memory/908-15-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/908-17-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/908-57-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/908-56-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/908-55-0x00000000065C0000-0x00000000065C1000-memory.dmpFilesize
4KB
-
memory/908-41-0x00000000062B0000-0x00000000062B1000-memory.dmpFilesize
4KB
-
memory/908-8-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/908-40-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/908-7-0x0000000000000000-mapping.dmp
-
memory/908-32-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/908-11-0x0000000073F20000-0x000000007460E000-memory.dmpFilesize
6.9MB
-
memory/1000-9-0x0000000000000000-mapping.dmp
-
memory/1440-24-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1440-21-0x00000000020A0000-0x00000000020B1000-memory.dmpFilesize
68KB
-
memory/1440-20-0x0000000000000000-mapping.dmp
-
memory/1512-10-0x0000000000000000-mapping.dmp