Analysis
-
max time kernel
108s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 07:05
General
-
Target
000OUTQ080519103.pdf.exe
-
Size
1.0MB
-
MD5
8ac344e8cb598c14af5796abc76c86e6
-
SHA1
7389f4c44202f3e2b9589178bd5481ba45858644
-
SHA256
0f97e6f8d53f551a068c3651d0c684f2813ff870b5cad591d536342aaf46a38f
-
SHA512
c0f39838fd96a36a484875f523da9777c4e94edeeb9e871394a33eb980832ca398354b4f61645728da593d7959c9456d38d1b7ed8a41e77ade52982da60464e9
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\000OUTQ080519103.pdf.exe"C:\Users\Admin\AppData\Local\Temp\000OUTQ080519103.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WDHjoSwByQNBZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6D9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\000OUTQ080519103.pdf.exe"C:\Users\Admin\AppData\Local\Temp\000OUTQ080519103.pdf.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD6D9.tmpMD5
1dd67d4ab97f4e3f8672245d7d6250de
SHA15724658266066109d3d773d0bbd14fce8736c610
SHA256d910e33501d1fa9cfa3eace55f48502bbdaa98ccf3f930e99636f15b8081de51
SHA5123614022e16d48b8bd80c55571b8f7bce7970c885a0d5944112af200a0c71c0c6f7762ccf47b7af89bc1d755f25961a16f818787f2308564713ff789cf12ae140
-
memory/2748-21-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2748-17-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2748-18-0x0000000000402980-mapping.dmp
-
memory/3888-15-0x0000000000000000-mapping.dmp
-
memory/4020-7-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/4020-9-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/4020-10-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/4020-11-0x0000000008BE0000-0x0000000008BE4000-memory.dmpFilesize
16KB
-
memory/4020-12-0x000000007ECE0000-0x000000007ECE1000-memory.dmpFilesize
4KB
-
memory/4020-13-0x00000000070E0000-0x0000000007196000-memory.dmpFilesize
728KB
-
memory/4020-14-0x00000000072A0000-0x0000000007318000-memory.dmpFilesize
480KB
-
memory/4020-8-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4020-2-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/4020-6-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/4020-5-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/4020-3-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB