Analysis
-
max time kernel
166s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en -
submitted
15-09-2021 07:32
Static task
static1
Behavioral task
behavioral1
Sample
Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe
-
Size
4.3MB
-
MD5
570090a065948e6d439e2b99f999f0a4
-
SHA1
0f2bf4aad8e12a340e37457566edb9e6816eee9e
-
SHA256
12ee6f798c7c0ade1d6f99819e7a4e714a22abb9a4c5b78506413dfc1d97eb3a
-
SHA512
37e5d43d7fb893556aff079a696e13db4b7d186576a268eeb512a86790caf9fc370e4b737a6c3cc53b46bd5c311a801f0733c9c414e0750aa28db78e6cf3ee01
Malware Config
Extracted
Family
metasploit
Version
windows/single_exec
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1672-53-0x00000000040B0000-0x00000000049D6000-memory.dmp family_glupteba behavioral1/memory/1672-54-0x0000000000400000-0x00000000021A4000-memory.dmp family_glupteba behavioral1/memory/1492-55-0x0000000000400000-0x00000000021A4000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-22 = "Cape Verde Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-491 = "India Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-552 = "North Asia Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-581 = "North Asia East Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-421 = "Russian Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-471 = "Ekaterinburg Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exepid process 1672 Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exedescription pid process Token: SeDebugPrivilege 1672 Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe Token: SeImpersonatePrivilege 1672 Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe"C:\Users\Admin\AppData\Local\Temp\Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe"C:\Users\Admin\AppData\Local\Temp\Latex+A5+Booklet+Template-PLND-ABMwKmEcmwAABTwCAEdCFwASAN3i2g8A.exe"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-56-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmpFilesize
8KB
-
memory/1492-55-0x0000000000400000-0x00000000021A4000-memory.dmpFilesize
29.6MB
-
memory/1672-53-0x00000000040B0000-0x00000000049D6000-memory.dmpFilesize
9.1MB
-
memory/1672-54-0x0000000000400000-0x00000000021A4000-memory.dmpFilesize
29.6MB