Analysis
-
max time kernel
119s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 21:35
Static task
static1
Behavioral task
behavioral1
Sample
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
Resource
win10-en-20211208
General
-
Target
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
-
Size
126KB
-
MD5
260349f5343244c439b211d9f9ff53cf
-
SHA1
5fbf3ca23f97deb97647ace003308129eeeac1ce
-
SHA256
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b
-
SHA512
1c75c910e387dc2b1f20d45b418e38bccf1211ae23acc7163b26b9ed73271443115f2a2c5bf95e26356e2eb8dac90cd17d6d337c1dc4f1e4bfa232a5e7749714
Malware Config
Signatures
-
Sakula Payload 10 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula \Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula C:\Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula C:\Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 2 IoCs
Processes:
pdfforie.exeAdobeUpdate.exepid process 1548 pdfforie.exe 268 AdobeUpdate.exe -
Loads dropped DLL 6 IoCs
Processes:
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exepdfforie.exeAdobeUpdate.exepid process 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe 1548 pdfforie.exe 268 AdobeUpdate.exe 268 AdobeUpdate.exe 268 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pdfforie.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" pdfforie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05DF8891-8232-11EC-A33B-DAFD849E4E7E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000dfe42ccff1cc8ffebe2ad81d6775196ec422e7baa490a834e93be868d471072a000000000e800000000200002000000057a962c5d7656c2b90319d69ca275f696251831d9d4171a71aa4edbfb8504f32200000000394979ce63a4253dfae44c9bc680b516bb96b28b7baf9a0e99e1f81ccb411a6400000000adf1876a5834097c081dee16a62952d78e6e657c13d94ddfc9b095a315d444b4b4f19d589c05bcfe7e36f5ceb5908dde15e2efd3482f6723006b3a08c9df7a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000214466f9bdf40e280d40a469b3dfb27713cb829b853d6327cb712146f9331779000000000e8000000002000020000000681636819dff286d1b330895f88ef07e478195fda4f92fb4c3e8e0d72afc01c190000000ffc7bd1ff9913b6cc4e5a0e827c6acbbaecb02bbd303f9cffd6207d651d0e65bdf01197e2bbca5c23cbad61e829ca5593ac056770991b01b907b21a4235f1b4307fcde2b2051540c213821edbda065e858909bc5e723f38a6e7bd530f1804231a3243fba069d87b33501d709e0175d3be810745d5085e19cc5c446562617ddb76a1de3d7b6d9db4cb959c53243a4474a40000000c02ba0b59814229447dd797320ee0d7f0be75a9f1ef5f87ae7505ab857502d8c9b8f983851d505bb10d9d6bb9171278c832754cea2a8c0b9923f808a643b2e09 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "350356168" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06389ec3e16d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pdfforie.exedescription pid process Token: SeIncBasePriorityPrivilege 1548 pdfforie.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 576 iexplore.exe 576 iexplore.exe 980 IEXPLORE.EXE 980 IEXPLORE.EXE 980 IEXPLORE.EXE 980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exepdfforie.exeiexplore.execmd.exedescription pid process target process PID 1896 wrote to memory of 1548 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 1896 wrote to memory of 1548 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 1896 wrote to memory of 1548 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 1896 wrote to memory of 1548 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 1896 wrote to memory of 576 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 1896 wrote to memory of 576 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 1896 wrote to memory of 576 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 1896 wrote to memory of 576 1896 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 1548 wrote to memory of 268 1548 pdfforie.exe AdobeUpdate.exe PID 576 wrote to memory of 980 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 980 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 980 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 980 576 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1316 1548 pdfforie.exe cmd.exe PID 1548 wrote to memory of 1316 1548 pdfforie.exe cmd.exe PID 1548 wrote to memory of 1316 1548 pdfforie.exe cmd.exe PID 1548 wrote to memory of 1316 1548 pdfforie.exe cmd.exe PID 1316 wrote to memory of 288 1316 cmd.exe PING.EXE PID 1316 wrote to memory of 288 1316 cmd.exe PING.EXE PID 1316 wrote to memory of 288 1316 cmd.exe PING.EXE PID 1316 wrote to memory of 288 1316 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe"C:\Users\Admin\AppData\Local\Temp\b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\pdfforie.exeC:\Users\Admin\AppData\Local\Temp\pdfforie.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\pdfforie.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:288 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.qzbwcq.com/cookie.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:980
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee
-
MD5
7aa1bbda65f46b885f75792d964334f7
SHA12fad57b99fe363cee17d88ff2bbe6ebdd95715c3
SHA2564049ac5f5eb6ccb9edb4e180318edf60a43669c1b8caa36cb001eb960a360609
SHA51261bad87803a9db1c497095ec5a7066b349d4c38f2c9eee39d72251816fc48a89c769c643361df1d79c37d80d77bf8c10f3324054b4131a59abe645ebecf2348a
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
c8c432b8790f926d289596b3962a7c82
SHA1417af479901efcbba091a8ca4eafb9c05c33c35e
SHA256d016ab6695dd0b03b0df05cca09bff0274e4ef8dee2f6ea1085ac4debcf2b0a1
SHA51211f6025a5fc77983ee2216806c964c08dce521ddd6285d87cc88b69036ea4ed854a06a5372748d9541b205470f5c6a61508c15dfa7ddd98ee05e8e8def3f1c1d
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee