Analysis
-
max time kernel
9s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
Confirmed order#PR2100906.pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Confirmed order#PR2100906.pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Confirmed order#PR2100906.pdf.exe
-
Size
50KB
-
MD5
ea2ab18853713d0dbb69b49354b75507
-
SHA1
7a6ec638ba7c07c7278d3d9e585c69de45751b56
-
SHA256
94bb5cf3b2d56807ecdff0d731b5bea776de7a22bd15c3bdd256157e8a0c02b8
-
SHA512
2e8fac506df7eddc9964b3df9f8ddfb5263fab55d4168ccd79ea29378cce63e0785a098c0c352c02aaabd39e8bb9afe248d51ac9f37b71aad545bf872c45f744
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
Confirmed order#PR2100906.pdf.exepid process 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2012 timeout.exe -
Processes:
Confirmed order#PR2100906.pdf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Confirmed order#PR2100906.pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Confirmed order#PR2100906.pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Confirmed order#PR2100906.pdf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Confirmed order#PR2100906.pdf.exepid process 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe 4768 Confirmed order#PR2100906.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Confirmed order#PR2100906.pdf.exedescription pid process Token: SeDebugPrivilege 4768 Confirmed order#PR2100906.pdf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Confirmed order#PR2100906.pdf.execmd.exedescription pid process target process PID 4768 wrote to memory of 3840 4768 Confirmed order#PR2100906.pdf.exe cmd.exe PID 4768 wrote to memory of 3840 4768 Confirmed order#PR2100906.pdf.exe cmd.exe PID 4768 wrote to memory of 3840 4768 Confirmed order#PR2100906.pdf.exe cmd.exe PID 3840 wrote to memory of 2012 3840 cmd.exe timeout.exe PID 3840 wrote to memory of 2012 3840 cmd.exe timeout.exe PID 3840 wrote to memory of 2012 3840 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmed order#PR2100906.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmed order#PR2100906.pdf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-9-0x0000000000000000-mapping.dmp
-
memory/3840-8-0x0000000000000000-mapping.dmp
-
memory/4768-2-0x0000000073360000-0x0000000073A4E000-memory.dmpFilesize
6.9MB
-
memory/4768-3-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/4768-5-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/4768-6-0x0000000006620000-0x0000000006621000-memory.dmpFilesize
4KB
-
memory/4768-7-0x0000000006140000-0x000000000616B000-memory.dmpFilesize
172KB
-
memory/4768-10-0x0000000007070000-0x0000000007071000-memory.dmpFilesize
4KB