Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 21:35
Static task
static1
Behavioral task
behavioral1
Sample
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
Resource
win10-en-20211208
General
-
Target
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe
-
Size
126KB
-
MD5
260349f5343244c439b211d9f9ff53cf
-
SHA1
5fbf3ca23f97deb97647ace003308129eeeac1ce
-
SHA256
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b
-
SHA512
1c75c910e387dc2b1f20d45b418e38bccf1211ae23acc7163b26b9ed73271443115f2a2c5bf95e26356e2eb8dac90cd17d6d337c1dc4f1e4bfa232a5e7749714
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula C:\Users\Admin\AppData\Local\Temp\pdfforie.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Executes dropped EXE 2 IoCs
Processes:
pdfforie.exeAdobeUpdate.exepid process 1356 pdfforie.exe 2232 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pdfforie.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" pdfforie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "346054787" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "346103373" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "346071394" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16B64217-5B13-11EC-876A-E63C55DA7BCE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce00000000020000000000106600000001000020000000e79a90fc7f1c87ee34c22179c976553f1d56ab0e2de9b6112a687d64ec000b4a000000000e8000000002000020000000402d8ba577005e998b8a727bbfee79f4ceb5b5e901862a90168b17daef3fceb320000000a1e744a0a945ed5c7fb2088b4d836ab29b44fd062fa46984109abd6d5d8a466340000000483992367ee4150d1878c0da990eaa2f9a3603c448763c5f6aab754b6dc54a1414c1cc35f6f903b47e9a079d76f715311e206a4ebf49c33a31ab0daa3c5ec718 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a790f21fefd701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3997385983" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30928671" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3959729583" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30928671" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073ba28bec77bbe4ba4dd58ffcd9527ce000000000200000000001066000000010000200000002c89820ea8434f3547a611d323068f704037a3c9900bc0243fd15cb243cdb1f2000000000e80000000020000200000005534d9a98edeb863ca892928b51d4e1967bb26807db9f5364ea86105e2dfc68f20000000a3670241e608b653a07f4845d1c7c60323e6687015c35ed1c983470d124b8ac94000000000ca8fe1d6d95e4c06f215c1140fcd38928e8f50bc8b2f6348d1f5c029aae90b0412b318b380aaabf324eb11fdcd4df423d83098d6e944f4ddab9b607f0cc2aa iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f063dff21fefd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3959729583" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30928671" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1212 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pdfforie.exedescription pid process Token: SeIncBasePriorityPrivilege 1356 pdfforie.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1212 iexplore.exe 1212 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exepdfforie.exeiexplore.execmd.exedescription pid process target process PID 596 wrote to memory of 1356 596 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 596 wrote to memory of 1356 596 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 596 wrote to memory of 1356 596 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe pdfforie.exe PID 596 wrote to memory of 1212 596 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 596 wrote to memory of 1212 596 b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe iexplore.exe PID 1356 wrote to memory of 2232 1356 pdfforie.exe AdobeUpdate.exe PID 1356 wrote to memory of 2232 1356 pdfforie.exe AdobeUpdate.exe PID 1356 wrote to memory of 2232 1356 pdfforie.exe AdobeUpdate.exe PID 1212 wrote to memory of 2276 1212 iexplore.exe IEXPLORE.EXE PID 1212 wrote to memory of 2276 1212 iexplore.exe IEXPLORE.EXE PID 1212 wrote to memory of 2276 1212 iexplore.exe IEXPLORE.EXE PID 1356 wrote to memory of 1348 1356 pdfforie.exe cmd.exe PID 1356 wrote to memory of 1348 1356 pdfforie.exe cmd.exe PID 1356 wrote to memory of 1348 1356 pdfforie.exe cmd.exe PID 1348 wrote to memory of 720 1348 cmd.exe PING.EXE PID 1348 wrote to memory of 720 1348 cmd.exe PING.EXE PID 1348 wrote to memory of 720 1348 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe"C:\Users\Admin\AppData\Local\Temp\b8bc59f0a3c34720a5f47b2cf769548f9c057605a94fe5e06361bbeb9801641b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\pdfforie.exeC:\Users\Admin\AppData\Local\Temp\pdfforie.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe3⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\pdfforie.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:720 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.qzbwcq.com/cookie.html2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD577913080540cc7373c6757efd172eba7
SHA113f05349210ec6bf2af101f44fe8f6e37b303daf
SHA2568be7e5dd8ee384a264a5813e199eddb7b8710b082d638294c72c6fb518257d16
SHA512dad482654e8026918c5cb61eb992f58626fa787ce85769457f4544bf4e3204693f5271d31bf62f85de9d05adc49ef4865ae1ece1c58849e94da5475e59d6db11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5155060501c30219334cc00b4fb322170
SHA140547e5ed6c298573e1858a3afe05db78a986aad
SHA2565c5670a29e04c3d0e74018467bbfc1b44830b04a50a1328edf3cb546713a477f
SHA5128422f57311aa832342e603c233bf39d04debdce5d2474bcf87cd6973e93a6dcdf079ac5b053e2178e5d36f63a4993aefde5484e74da25fddcf4afb11f7bf7648
-
MD5
1bca38abaf718e8c22dd45745878c833
SHA154185ee31e40bbe891bdf965d8188872b333ef42
SHA256b38e708cb152518302b74586691064d723763db3a8e898d69b1b50b44ecc2ea9
SHA512036a2f6d0405596448194f42509f913187c10c223134b3467bd6919e7cf2c4f8ec969f57174c54a40932507aa0e530c12e44dd08b2685cdca07f6c8270e284dd
-
MD5
0f43d3de510a47e839341629c21b8ef4
SHA1b1b0777274352ac396b08e0f0a0f79ead5e3ad47
SHA2561aeac003b44b1fae08355ba2d506c4750d54e9b958896c7efe7e66f8e943c28f
SHA5124becfa07d78759e38ef7c1dc41d00b43c2b449cdfd6d54938e7210e9f493104613bbf8c64ad04b87709ee9c29d969df39f7b73ee9b9b6e112ee114314f9eb05d
-
MD5
0f43d3de510a47e839341629c21b8ef4
SHA1b1b0777274352ac396b08e0f0a0f79ead5e3ad47
SHA2561aeac003b44b1fae08355ba2d506c4750d54e9b958896c7efe7e66f8e943c28f
SHA5124becfa07d78759e38ef7c1dc41d00b43c2b449cdfd6d54938e7210e9f493104613bbf8c64ad04b87709ee9c29d969df39f7b73ee9b9b6e112ee114314f9eb05d
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee
-
MD5
191696982f3f21a6ac31bf3549c94108
SHA1b28806efad1136d03a4e6f34ed9d826fd828b535
SHA25622f5fa60c2286e22bee79bcde6e9c7ee80b42ef308c6bb7aed6d6163e5da0214
SHA512aa6d79fbce14f68e47dd7719e7dcb688dfd72b63db4e8ad3976351494df7221684621468380828c1aeca9f77c1156c8317524ee972696225c0d9be0dde8815ee