f6d0fdcf620ebd3b483c6dd7e9bc7bea2f9acca8d34eb7b84ebaf457671fd758

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
08/12/2021, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E V0149 - P0843437 KS + P0843438 MA,pdf.exe
Size 772KB
Sample211208-pll6jsacdr
SHA256 f6d0fdcf620ebd3b483c6dd7e9bc7bea2f9acca8d34eb7b84ebaf457671fd758
MD5 6c1386c56c3abc576ba1add269ae705d
SHA1 fc71dc902ea74fbd7c29de9d0f5e322f5fa61c37
SHA512 7c70d3888c71502406ac7ad5940d1438b250bb12d823999428138be0bcaf32ac1b7537855906e28ac8fedef7da4ada54eee6c62d0b97ea09bd9c732eb74ad330
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lszkdxuq = "C:\\Users\\Admin\\quxdkzsL.url"	E V0149 - P0843437 KS + P0843438 MA,pdf.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30
PID 1088 wrote to memory of 1288	1088	E V0149 - P0843437 KS + P0843438 MA,pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\E V0149 - P0843437 KS + P0843438 MA,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\E V0149 - P0843437 KS + P0843438 MA,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/1088-56-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1088-57-0x00000000005D1000-0x00000000005E5000-memory.dmp

Download

memory/1288-58-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1288-64-0x0000000000080000-0x0000000000081000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads