Analysis
-
max time kernel
64s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-05-2022 05:16
General
-
Target
PO-9768708-Hyundai-09221-6138 pdf.exe
-
Size
702KB
-
MD5
5df0240aa06b38e1a88fde9c6c5c306e
-
SHA1
2a3d233fed9ea294b049061fe85e471cabc83f97
-
SHA256
869fa23919d381e4af0d8c04881d65ad842cb96020da5c1e16f65c48190d3eef
-
SHA512
cfff543c68effd0051e6f29be985e6527f317ea5813bc695de4b0a97bda68ca29f6d05c3a9b6efb9bf98596aef403d25373c3bcf58d10f84678b276d52b6d8a0
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-9768708-Hyundai-09221-6138 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-9768708-Hyundai-09221-6138 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KPwtapzko.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KPwtapzko" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF9F.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PO-9768708-Hyundai-09221-6138 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-9768708-Hyundai-09221-6138 pdf.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5319a273b68894a8032e131c72438fd84
SHA13ce9745d2ac9a95283924088df85e7002137aeeb
SHA25603acc711d098ebfe378410e02ae0a7057283814a546536ca30bbf2c2a1cd476c
SHA512a191be432baf59f5d1192b59a76bb0ac5d85172603a39b45575c535dddec3b79d5b6b8099267b8183a0d99ce41bca060398169619a35cf27864eabfaadb158bf
-
Filesize
720KB
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
568KB
-
Filesize
296KB
-
-
Filesize
5.7MB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-