ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e

General

Target

ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe
Size

435KB
MD5

12c78eb58d6739303f370dba8c9501bc
SHA1

802c4f0d5f9cf2b40520177fff64cbe242b3988a
SHA256

ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e
SHA512

3e2875ac117c6b091003cd61866f5bac742d4678b116d93913cc4a153c120802a7ab3eceb4eaf228e88462d7588e6be748912fa65c3c2d2121a1eaa72cf6fb85

Score

8^/10

link pdf persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SVCHOST.exe

pid process

1176 SVCHOST.exe

pid	process
1176	SVCHOST.exe

Loads dropped DLL 4 IoCs

Processes:

ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe

pid	process
1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe
1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe
1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe
1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SVCHOST.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMD_dc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SVCHOST.exe"	SVCHOST.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Recollection Of My Mayor-time In Roberval(Denis Lebel).pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1660 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1660 AcroRd32.exe
1660 AcroRd32.exe
1660 AcroRd32.exe
1660 AcroRd32.exe

pid	process
1660	AcroRd32.exe

pid	process
1660	AcroRd32.exe
1660	AcroRd32.exe
1660	AcroRd32.exe
1660	AcroRd32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe

description	pid	process	target process
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1660	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	AcroRd32.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe
PID 1096 wrote to memory of 1176	1096	ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe	SVCHOST.exe

C:\Users\Admin\AppData\Local\Temp\ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe
"C:\Users\Admin\AppData\Local\Temp\ab3054a54af3808532968a950a3ca056b4bf875d6cf51fc26309040446374b9e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Recollection Of My Mayor-time In Roberval(Denis Lebel).pdf"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Users\Admin\AppData\Local\Temp\SVCHOST.exe
"C:\Users\Admin\AppData\Local\Temp\SVCHOST.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Recollection Of My Mayor-time In Roberval(Denis Lebel).pdf
MD5
d7fe76a07d0b3930057bff95ec82040b

SHA1
7aa5c183539cb5a3aac8dca29d1a7eb712a510e5

SHA256
e87aa4203e9ce19eb5ad1a50d4111d8fb9cbdf84c2ff21067a3f76a38b1411f0

SHA512
53da8a0da15d8173820686f25163271932d07f0c2f9f5583d93439bc4dfb240dd8538796d1288aa521cea5a00218a111f3f396c010524c562761a3eefdc5c2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SVCHOST.exe
MD5
2154815bb388e44567fd88f1a5351112

SHA1
492fe05bfc16d6b4571c64e9b04b7e5df8be1a9d

SHA256
c463de0b0334940ef533c9109f49edbb931b7c060c083ae2256a9c6ce389f95c

SHA512
77556679e86085d62b5831e4f2d56514e9472150cb9cefab82d48b55ccfcce4c137b9a3df294d4f459c3410902a86caf50b1c402490fa9dbe8dcde34c40923f1

Download Submit
\Users\Admin\AppData\Local\Temp\SVCHOST.exe
MD5
2154815bb388e44567fd88f1a5351112

SHA1
492fe05bfc16d6b4571c64e9b04b7e5df8be1a9d

SHA256
c463de0b0334940ef533c9109f49edbb931b7c060c083ae2256a9c6ce389f95c

SHA512
77556679e86085d62b5831e4f2d56514e9472150cb9cefab82d48b55ccfcce4c137b9a3df294d4f459c3410902a86caf50b1c402490fa9dbe8dcde34c40923f1

Download Submit
\Users\Admin\AppData\Local\Temp\SVCHOST.exe
MD5
2154815bb388e44567fd88f1a5351112

SHA1
492fe05bfc16d6b4571c64e9b04b7e5df8be1a9d

SHA256
c463de0b0334940ef533c9109f49edbb931b7c060c083ae2256a9c6ce389f95c

SHA512
77556679e86085d62b5831e4f2d56514e9472150cb9cefab82d48b55ccfcce4c137b9a3df294d4f459c3410902a86caf50b1c402490fa9dbe8dcde34c40923f1

Download Submit
\Users\Admin\AppData\Local\Temp\SVCHOST.exe
MD5
2154815bb388e44567fd88f1a5351112

SHA1
492fe05bfc16d6b4571c64e9b04b7e5df8be1a9d

SHA256
c463de0b0334940ef533c9109f49edbb931b7c060c083ae2256a9c6ce389f95c

SHA512
77556679e86085d62b5831e4f2d56514e9472150cb9cefab82d48b55ccfcce4c137b9a3df294d4f459c3410902a86caf50b1c402490fa9dbe8dcde34c40923f1

Download Submit
\Users\Admin\AppData\Local\Temp\SVCHOST.exe
MD5
2154815bb388e44567fd88f1a5351112

SHA1
492fe05bfc16d6b4571c64e9b04b7e5df8be1a9d

SHA256
c463de0b0334940ef533c9109f49edbb931b7c060c083ae2256a9c6ce389f95c

SHA512
77556679e86085d62b5831e4f2d56514e9472150cb9cefab82d48b55ccfcce4c137b9a3df294d4f459c3410902a86caf50b1c402490fa9dbe8dcde34c40923f1

Download Submit
memory/1096-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads