Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Doc_3957495686846574893974939464936488463936484,pdf.exe
Resource
win7v20201028
General
-
Target
Doc_3957495686846574893974939464936488463936484,pdf.exe
-
Size
77KB
-
MD5
1662b1ff6de1371a09ecabb5a2c14905
-
SHA1
5a9353c5b8b1e1b19b7879cd483c9f715237c478
-
SHA256
3a220e6bff537b270991d1bb49e530c7279fb643f8a9b5998bbefae6140a19f4
-
SHA512
ae20025d79fbfbf85bceeaca71fcd170966eaa71761dffc4d96405311e314f44b4f6d5573747b6923da0477c0a2ba1ecd95c14e917aa9408c157c6964fd3b68f
Malware Config
Extracted
formbook
http://www.aubonmarcheduparc.com/rina/
syndicauto.net
techvorx.com
palletrackingvancouver.com
pricetrackerindia.com
photocravings.com
jenniferlwilsonrn.com
cartucce-toner.com
fred-auto-sport.com
aletheajean.com
beautyhacks.website
seoalmaguer.com
cursoencasa.net
flex-eg.com
dygdreams.com
magnoliadawson.com
whitehouseeffectband.com
visualtrigger.art
kalinahybridseeds.com
glacesnamur.com
drbordogna.com
wealthtells.com
opaoman.xyz
ieltsjo.com
graphicoustic.com
jimboprivacy.com
blockchainclood.com
aulsgdcqg.icu
swipeonyourself.com
mccraft.club
scirispartner.com
mlinkstec.com
allungamentopene.net
quailridgeminischnauzers.com
teensatoz.com
3rud.net
921squirecourt.com
informaticas.net
unicorndragonlearning.com
duniatone.com
abmzc023.com
meteorproductions.com
pinkcouturecollection.com
dealsaction.store
kailarosales.com
maya-watches.com
ladyunivers.com
magenx2.info
3ppschool.com
panl.online
intelligenten.com
pepintre.com
safarimadeira.info
westglobalpartners.com
tamilfgun.com
upholsteredwineracks.com
superdoctormk.club
newfacesatv.info
play-morepools.com
allservice.center
ladyandpen.com
textileetobjet.com
dallasgains.com
littledeviltrainingcollar.com
liquid-metalworks.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-16-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral1/memory/1544-17-0x000000000041D0A0-mapping.dmp xloader -
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths Doc_3957495686846574893974939464936488463936484,pdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions Doc_3957495686846574893974939464936488463936484,pdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe -
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Doc_3957495686846574893974939464936488463936484,pdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exepid process 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription pid process target process PID 892 set thread context of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 956 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeDoc_3957495686846574893974939464936488463936484,pdf.exeDoc_3957495686846574893974939464936488463936484,pdf.exepid process 768 powershell.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 892 Doc_3957495686846574893974939464936488463936484,pdf.exe 1544 Doc_3957495686846574893974939464936488463936484,pdf.exe 768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Token: SeDebugPrivilege 768 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.execmd.exedescription pid process target process PID 892 wrote to memory of 768 892 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 892 wrote to memory of 768 892 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 892 wrote to memory of 768 892 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 892 wrote to memory of 768 892 Doc_3957495686846574893974939464936488463936484,pdf.exe powershell.exe PID 892 wrote to memory of 1716 892 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 892 wrote to memory of 1716 892 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 892 wrote to memory of 1716 892 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 892 wrote to memory of 1716 892 Doc_3957495686846574893974939464936488463936484,pdf.exe cmd.exe PID 1716 wrote to memory of 956 1716 cmd.exe timeout.exe PID 1716 wrote to memory of 956 1716 cmd.exe timeout.exe PID 1716 wrote to memory of 956 1716 cmd.exe timeout.exe PID 1716 wrote to memory of 956 1716 cmd.exe timeout.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe PID 892 wrote to memory of 1544 892 Doc_3957495686846574893974939464936488463936484,pdf.exe Doc_3957495686846574893974939464936488463936484,pdf.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
Doc_3957495686846574893974939464936488463936484,pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Doc_3957495686846574893974939464936488463936484,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:956 -
C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Doc_3957495686846574893974939464936488463936484,pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-24-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/768-12-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/768-14-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/768-53-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/768-7-0x0000000000000000-mapping.dmp
-
memory/768-8-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/768-52-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/768-38-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/768-11-0x0000000073D30000-0x000000007441E000-memory.dmpFilesize
6.9MB
-
memory/768-21-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/768-13-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/768-15-0x0000000000D12000-0x0000000000D13000-memory.dmpFilesize
4KB
-
memory/768-54-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/768-37-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/768-30-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/768-18-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/768-29-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/892-5-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/892-2-0x0000000073D30000-0x000000007441E000-memory.dmpFilesize
6.9MB
-
memory/892-6-0x00000000008C0000-0x000000000095B000-memory.dmpFilesize
620KB
-
memory/892-3-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/956-10-0x0000000000000000-mapping.dmp
-
memory/1544-20-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1544-17-0x000000000041D0A0-mapping.dmp
-
memory/1544-16-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1716-9-0x0000000000000000-mapping.dmp