56055b9e7bc2e6577527cb86ca9e8598fa7caf9a909bbdb3e69b27a2236c9da9

General

Target
Payment Advice copy 000030,pdf.exe
Size 3.3MB
Sample210802-nryxp1l56s
SHA256 56055b9e7bc2e6577527cb86ca9e8598fa7caf9a909bbdb3e69b27a2236c9da9
MD5 ae687391859bad88072fd1a6fd1fd7dc
SHA1 7f69986f9fa5eeb942c984e62124674ff6322d47
SHA512 4570a3ce945050cad351bd5f6b5ce5f6d0a1b44ee7f00874ecbd45317257dfdb671d0d69f1677bfa572fe5b062f8ab5ef9cf62a7d3f8ae4da367cddd8cb0477f
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Payment Advice copy 000030,pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Payment Advice copy 000030,pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 2384	3968	Payment Advice copy 000030,pdf.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	Payment Advice copy 000030,pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3412	3968	Payment Advice copy 000030,pdf.exe	78
PID 3968 wrote to memory of 3412	3968	Payment Advice copy 000030,pdf.exe	78
PID 3968 wrote to memory of 3412	3968	Payment Advice copy 000030,pdf.exe	78
PID 3968 wrote to memory of 2348	3968	Payment Advice copy 000030,pdf.exe	80
PID 3968 wrote to memory of 2348	3968	Payment Advice copy 000030,pdf.exe	80
PID 3968 wrote to memory of 2348	3968	Payment Advice copy 000030,pdf.exe	80
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81
PID 3968 wrote to memory of 2384	3968	Payment Advice copy 000030,pdf.exe	81

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Payment Advice copy 000030,pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Payment Advice copy 000030,pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Payment Advice copy 000030,pdf.exe

C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GJLaDVFGTo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD9DB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe"
  2⤵
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advice copy 000030,pdf.exe"
  2⤵
  - Checks whether UAC is enabled
  - System policy modification
  PID:2384