4b052753c4ac62ea2b88d0fcc74ef9f2bd1944d733ee603f1fefaa3d9d23171c

Analysis

max time kernel
7s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PI_160420PDF ARJ005634420200429 ,pdf.exe
Size

781KB
MD5

e132a0c2ded7c6dd950cc745862896b1
SHA1

c63c29aefc1245fb66f67d0049cc682c76d6287b
SHA256

2cc9a439b0ba13097ff33a8bb0af64130fec5c4f128c5cc4fcec7403e55ff50c
SHA512

7ffe8b5e25f6b7b24cb5453de02b098273747d08fc4a9195791cef9876af43baf2daacb1e4785d7e416f50874b0340856b5cad7e8eded5db461cc68d0055d584

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PI_160420PDF ARJ005634420200429 ,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\None"	PI_160420PDF ARJ005634420200429 ,pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PI_160420PDF ARJ005634420200429 ,pdf.exe

description pid process target process

PID 4608 set thread context of 3400 4608 PI_160420PDF ARJ005634420200429 ,pdf.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

PI_160420PDF ARJ005634420200429 ,pdf.exe

pid process

4608 PI_160420PDF ARJ005634420200429 ,pdf.exe
4608 PI_160420PDF ARJ005634420200429 ,pdf.exe

description	pid	process	target process
PID 4608 set thread context of 3400	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe

pid	process
4608	PI_160420PDF ARJ005634420200429 ,pdf.exe
4608	PI_160420PDF ARJ005634420200429 ,pdf.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

PI_160420PDF ARJ005634420200429 ,pdf.exe

description	pid	process	target process
PID 4608 wrote to memory of 2760	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 2760	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 2760	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 3400	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 3400	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 3400	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe
PID 4608 wrote to memory of 3400	4608	PI_160420PDF ARJ005634420200429 ,pdf.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-131-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4608-130-0x00000000007B0000-0x000000000087A000-memory.dmp

Filesize
808KB

Download