ae7f27cb47faadb14fd76d3669d0aa2bcbfccf8afb06da7431f55abd381a1197

Analysis

max time kernel
152s
max time network
143s
platform
windows10_x64
resource
win10-en-20211104
submitted
08/12/2021, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Confirmation.pdf.exe
Size 2.2MB
Sample211208-ntfhasaafn
SHA256 ae7f27cb47faadb14fd76d3669d0aa2bcbfccf8afb06da7431f55abd381a1197
MD5 6abb2287b6a858dbcfd46f31cb18295b
SHA1 2def43269a55a6e0d4cab3ca9486c77c0e29cac1
SHA512 32c1a78260ca3ed52c015024318d2b9ebb16558037be96cf3ce0bce88422e0e231ea2f48cd0b58aab4d9f76acd0e74775931cee73781e8274c983ac81e0842e7
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1836	LookupSvi.exe
3944	secdrv.exe
3720	AeLookupSvi.exe
1324	ProfSvc.exe
652	secdrv.exe
2544	secdrv.exe
1236	secdrv.exe
1016	secdrv.exe
1608	ProfSvc.exe
2244	ProfSvc.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk	Payment Confirmation.pdf.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Macrovision Security Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe"	LookupSvi.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 824	3656	Payment Confirmation.pdf.exe	69
PID 824 set thread context of 924	824	Payment Confirmation.pdf.exe	70
PID 924 set thread context of 676	924	Payment Confirmation.pdf.exe	71
PID 676 set thread context of 3468	676	Payment Confirmation.pdf.exe	72
PID 3468 set thread context of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3036 set thread context of 1020	3036	Payment Confirmation.pdf.exe	78
PID 1020 set thread context of 3536	1020	Payment Confirmation.pdf.exe	81
PID 3944 set thread context of 652	3944	secdrv.exe	83
PID 652 set thread context of 2544	652	secdrv.exe	84
PID 2544 set thread context of 1236	2544	secdrv.exe	85
PID 1236 set thread context of 1016	1236	secdrv.exe	86

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjavafxpackager.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjarsigner.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui	Payment Confirmation.pdf.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjava.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA3CD.tmp	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\RCXA614.tmp	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjinfo.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\7-Zip\v7zFM.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjavap.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjinfo.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXA547.tmp	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjavapackager.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjconsole.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\vDW20.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vAppSharingHookController.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vInspectorOfficeGadget.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjdb.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjps.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	Payment Confirmation.pdf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjavapackager.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vOfficeC2RClient.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjabswitch.ico	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjavac.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vkeytool.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vkinit.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vMavInject32.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA45A.tmp	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\vjvisualvm.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCXBF9F.tmp	Payment Confirmation.pdf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	Payment Confirmation.pdf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\7-Zip\v7zG.ico	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\vmisc.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\vOSPPREARM.EXE	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\vDW20.EXE	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\vSQLDumper.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\RCXA70F.tmp	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mip.exe.mui	Payment Confirmation.pdf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\vjavafxpackager.exe	Payment Confirmation.pdf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	Payment Confirmation.pdf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Payment Confirmation.pdf.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bfsvc.exe	Payment Confirmation.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe
3468	Payment Confirmation.pdf.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	924	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	676	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	3468	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	1836	LookupSvi.exe
Token: SeDebugPrivilege	3036	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	3720	AeLookupSvi.exe
Token: SeDebugPrivilege	1020	Payment Confirmation.pdf.exe
Token: SeDebugPrivilege	652	secdrv.exe
Token: SeDebugPrivilege	2544	secdrv.exe
Token: SeDebugPrivilege	1236	secdrv.exe
Token: SeDebugPrivilege	2244	ProfSvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 3656 wrote to memory of 824	3656	Payment Confirmation.pdf.exe	69
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 824 wrote to memory of 924	824	Payment Confirmation.pdf.exe	70
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 924 wrote to memory of 676	924	Payment Confirmation.pdf.exe	71
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 676 wrote to memory of 3468	676	Payment Confirmation.pdf.exe	72
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 3036	3468	Payment Confirmation.pdf.exe	73
PID 3468 wrote to memory of 1836	3468	Payment Confirmation.pdf.exe	74
PID 3468 wrote to memory of 1836	3468	Payment Confirmation.pdf.exe	74
PID 3468 wrote to memory of 1836	3468	Payment Confirmation.pdf.exe	74
PID 1836 wrote to memory of 3944	1836	LookupSvi.exe	77
PID 1836 wrote to memory of 3944	1836	LookupSvi.exe	77
PID 1836 wrote to memory of 3944	1836	LookupSvi.exe	77
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 1020	3036	Payment Confirmation.pdf.exe	78
PID 3036 wrote to memory of 3720	3036	Payment Confirmation.pdf.exe	79
PID 3036 wrote to memory of 3720	3036	Payment Confirmation.pdf.exe	79
PID 3036 wrote to memory of 3720	3036	Payment Confirmation.pdf.exe	79
PID 3720 wrote to memory of 1324	3720	AeLookupSvi.exe	80
PID 3720 wrote to memory of 1324	3720	AeLookupSvi.exe	80
PID 3720 wrote to memory of 1324	3720	AeLookupSvi.exe	80
PID 1020 wrote to memory of 3536	1020	Payment Confirmation.pdf.exe	81
PID 1020 wrote to memory of 3536	1020	Payment Confirmation.pdf.exe	81
PID 1020 wrote to memory of 3536	1020	Payment Confirmation.pdf.exe	81
PID 1020 wrote to memory of 3536	1020	Payment Confirmation.pdf.exe	81

C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.pdf.exe"
        8⤵
        Drops startup file
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:3536
        
        C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        8⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        9⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
      - C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:652
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
        11⤵
        Executes dropped EXE
        
        PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-226-0x0000000005200000-0x00000000056FE000-memory.dmp

Download

memory/676-149-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/676-156-0x0000000005430000-0x0000000005437000-memory.dmp

Download

memory/676-158-0x0000000004FF0000-0x00000000054EE000-memory.dmp

Download

memory/824-137-0x00000000057E0000-0x0000000005872000-memory.dmp

Download

memory/824-128-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/824-135-0x0000000005D30000-0x0000000005D36000-memory.dmp

Download

memory/924-146-0x0000000005AA0000-0x0000000005AA7000-memory.dmp

Download

memory/924-138-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/924-148-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/1016-258-0x00000000052D0000-0x00000000057CE000-memory.dmp

Download

memory/1020-203-0x0000000004FA0000-0x000000000549E000-memory.dmp

Download

memory/1020-193-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/1020-199-0x0000000002910000-0x0000000002916000-memory.dmp

Download

memory/1236-245-0x0000000004C80000-0x000000000517E000-memory.dmp

Download

memory/1836-180-0x0000000003080000-0x0000000003081000-memory.dmp

Download

memory/2244-268-0x00000000050E0000-0x00000000055DE000-memory.dmp

Download

memory/2544-236-0x0000000005320000-0x000000000581E000-memory.dmp

Download

memory/3036-169-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/3036-176-0x0000000005280000-0x0000000005312000-memory.dmp

Download

memory/3036-175-0x0000000005290000-0x0000000005296000-memory.dmp

Download

memory/3468-167-0x00000000058A0000-0x00000000058A8000-memory.dmp

Download

memory/3468-159-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/3468-166-0x0000000005760000-0x0000000005C5E000-memory.dmp

Download

memory/3536-209-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/3536-212-0x0000000000DC0000-0x0000000000E6E000-memory.dmp

Download

memory/3536-211-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/3656-127-0x0000000007E60000-0x00000000080E3000-memory.dmp

Download

memory/3656-122-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/3656-120-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/3656-118-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

memory/3656-121-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/3656-123-0x0000000004F40000-0x000000000543E000-memory.dmp

Download

memory/3656-126-0x0000000007800000-0x0000000007801000-memory.dmp

Download

memory/3656-125-0x0000000007480000-0x0000000007481000-memory.dmp

Download

memory/3656-124-0x0000000007470000-0x0000000007475000-memory.dmp

Download

memory/3720-204-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/3944-191-0x0000000005250000-0x000000000574E000-memory.dmp

Download

memory/3944-190-0x00000000071D0000-0x00000000071D1000-memory.dmp

Download