ae7f27cb47faadb14fd76d3669d0aa2bcbfccf8afb06da7431f55abd381a1197

Analysis

max time kernel
153s
max time network
117s
platform
windows7_x64
resource
win7-en-20211014
submitted
08/12/2021, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Confirmation.pdf.exe
Size 2.2MB
Sample211208-ntfhasaafn
SHA256 ae7f27cb47faadb14fd76d3669d0aa2bcbfccf8afb06da7431f55abd381a1197
MD5 6abb2287b6a858dbcfd46f31cb18295b
SHA1 2def43269a55a6e0d4cab3ca9486c77c0e29cac1
SHA512 32c1a78260ca3ed52c015024318d2b9ebb16558037be96cf3ce0bce88422e0e231ea2f48cd0b58aab4d9f76acd0e74775931cee73781e8274c983ac81e0842e7
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1396	LookupSvi.exe
1136	secdrv.exe
1124	LookupSvi.exe
1448	AeLookupSvi.exe
1632	ProfSvc.exe
1992	AeLookupSvi.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk	Payment Confirmation.pdf.exe

Loads dropped DLL 63 IoCs

pid	Process
968	Payment Confirmation.pdf.exe
1396	LookupSvi.exe
668	Payment Confirmation.pdf.exe
1448	AeLookupSvi.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe
1936	Payment Confirmation.pdf.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Macrovision Security Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe"	LookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Macrovision Security Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe"	LookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1836 set thread context of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1060 set thread context of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1664 set thread context of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1952 set thread context of 968	1952	Payment Confirmation.pdf.exe	31
PID 968 set thread context of 668	968	Payment Confirmation.pdf.exe	32
PID 668 set thread context of 1744	668	Payment Confirmation.pdf.exe	36
PID 1744 set thread context of 1936	1744	Payment Confirmation.pdf.exe	40

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\vchrome_pwa_launcher.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vidlj.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vjsadebugd.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjava.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vnative2ascii.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vkeytool.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\velevation_service.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjstat.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjavafxpackager.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vkeytool.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vklist.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\vcom.oracle.jmc.executable.win32.win32.x86_64_5.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\vchrmstp.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\vchrmstp.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjdb.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\vlauncher.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vjmc.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vktab.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vjava-rmi.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vserialver.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vjconsole.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vrmiregistry.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\vappletviewer.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjhat.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjrunscript.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui	Payment Confirmation.pdf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPSVC.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\vjavaw.ico	Payment Confirmation.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe
968	Payment Confirmation.pdf.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	1664	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	1952	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	968	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	1396	LookupSvi.exe
Token: SeDebugPrivilege	668	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	1124	LookupSvi.exe
Token: SeDebugPrivilege	1448	AeLookupSvi.exe
Token: SeDebugPrivilege	1744	Payment Confirmation.pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1836 wrote to memory of 1060	1836	Payment Confirmation.pdf.exe	28
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1060 wrote to memory of 1664	1060	Payment Confirmation.pdf.exe	29
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1664 wrote to memory of 1952	1664	Payment Confirmation.pdf.exe	30
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 1952 wrote to memory of 968	1952	Payment Confirmation.pdf.exe	31
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 668	968	Payment Confirmation.pdf.exe	32
PID 968 wrote to memory of 1396	968	Payment Confirmation.pdf.exe	33
PID 968 wrote to memory of 1396	968	Payment Confirmation.pdf.exe	33
PID 968 wrote to memory of 1396	968	Payment Confirmation.pdf.exe	33
PID 968 wrote to memory of 1396	968	Payment Confirmation.pdf.exe	33
PID 1396 wrote to memory of 1136	1396	LookupSvi.exe	34
PID 1396 wrote to memory of 1136	1396	LookupSvi.exe	34
PID 1396 wrote to memory of 1136	1396	LookupSvi.exe	34
PID 1396 wrote to memory of 1136	1396	LookupSvi.exe	34
PID 968 wrote to memory of 1124	968	Payment Confirmation.pdf.exe	35
PID 968 wrote to memory of 1124	968	Payment Confirmation.pdf.exe	35
PID 968 wrote to memory of 1124	968	Payment Confirmation.pdf.exe	35
PID 968 wrote to memory of 1124	968	Payment Confirmation.pdf.exe	35
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36
PID 668 wrote to memory of 1744	668	Payment Confirmation.pdf.exe	36

C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        6⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        8⤵
        Drops startup file
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:1936
        
        C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        8⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
        7⤵
        Executes dropped EXE
        
        PID:1992
      - C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1136
      - C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-105-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-101-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-103-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-102-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-104-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-115-0x0000000000510000-0x0000000000511000-memory.dmp

Download

memory/668-107-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/668-109-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/968-93-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/968-100-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/968-95-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/968-97-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/968-94-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/968-91-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/968-99-0x0000000000530000-0x0000000000538000-memory.dmp

Download

memory/968-92-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/1060-63-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1060-65-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1060-67-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1060-69-0x0000000000340000-0x0000000000346000-memory.dmp

Download

memory/1060-70-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/1060-64-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1060-62-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1060-61-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1124-128-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/1136-124-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/1136-121-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/1396-116-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1448-144-0x0000000001D40000-0x0000000001D41000-memory.dmp

Download

memory/1632-153-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/1632-149-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/1664-75-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-71-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-72-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-74-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-73-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-77-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/1664-79-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/1664-80-0x00000000006E0000-0x00000000006E7000-memory.dmp

Download

memory/1744-135-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-129-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-139-0x0000000000250000-0x0000000000256000-memory.dmp

Download

memory/1744-133-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-132-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-131-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-130-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1744-143-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/1836-57-0x0000000075D41000-0x0000000075D43000-memory.dmp

Download

memory/1836-58-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/1836-59-0x0000000000510000-0x0000000000515000-memory.dmp

Download

memory/1836-60-0x0000000008060000-0x00000000082E3000-memory.dmp

Download

memory/1836-55-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1936-171-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1936-170-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1952-87-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-82-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-83-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-84-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-85-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-81-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1952-89-0x0000000000550000-0x0000000000557000-memory.dmp

Download

memory/1952-90-0x0000000005010000-0x0000000005011000-memory.dmp

Download

memory/1992-157-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download