Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENTS pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DOCUMENTS pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
DOCUMENTS pdf.exe
-
Size
783KB
-
MD5
0f22eacae1316be03f6829946306b593
-
SHA1
3a3d3297ae8b1e96bc0fda3502a58d69447a2577
-
SHA256
b6cbbb6a53fb168a24f6a2f4bbf296547e5ece0314e2b9c21d6662af66a3ac4a
-
SHA512
3b74d936eb6faeab8ea2b37aee1bf90ee54e76a0e37f8ba08d2580908cb648d19da89720a51e5475298abfdab969a474f6145157e5b2662767f7a05795ab6e36
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DOCUMENTS pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation DOCUMENTS pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
DOCUMENTS pdf.exepid process 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe 4008 DOCUMENTS pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DOCUMENTS pdf.exedescription pid process Token: SeDebugPrivilege 4008 DOCUMENTS pdf.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
DOCUMENTS pdf.exedescription pid process target process PID 4008 wrote to memory of 2932 4008 DOCUMENTS pdf.exe schtasks.exe PID 4008 wrote to memory of 2932 4008 DOCUMENTS pdf.exe schtasks.exe PID 4008 wrote to memory of 2932 4008 DOCUMENTS pdf.exe schtasks.exe PID 4008 wrote to memory of 3984 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 3984 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 3984 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 2852 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 340 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 340 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 340 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 224 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe PID 4008 wrote to memory of 4864 4008 DOCUMENTS pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCUMENTS pdf.exe"C:\Users\Admin\AppData\Local\Temp\DOCUMENTS pdf.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3420.tmp"2⤵
- Creates scheduled task(s)
PID:2932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:3984
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:2852
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:340
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:224
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:4864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3420.tmpFilesize
1KB
MD5072541fbcc0f05e7e00afb8876087822
SHA10a1a6ad25a4a546520fe21bed23b4dd56f5ea7f5
SHA2568a98b2e2084e096028123a79228bc1b11f12179aecfbe53759b3e0805f973116
SHA51207074f512ee920a787af3d49d982795121051cc5cd1ce01d115aab63cd800fd58f2f57e73dafb96151e57ada9d2e407e370abc9c56d8ab604d118dad93c1412d
-
memory/224-140-0x0000000000000000-mapping.dmp
-
memory/340-139-0x0000000000000000-mapping.dmp
-
memory/2852-138-0x0000000000000000-mapping.dmp
-
memory/2932-135-0x0000000000000000-mapping.dmp
-
memory/3984-137-0x0000000000000000-mapping.dmp
-
memory/4008-130-0x0000000000E80000-0x0000000000F4A000-memory.dmpFilesize
808KB
-
memory/4008-131-0x0000000005F60000-0x0000000006504000-memory.dmpFilesize
5.6MB
-
memory/4008-132-0x00000000058D0000-0x0000000005962000-memory.dmpFilesize
584KB
-
memory/4008-133-0x0000000005980000-0x000000000598A000-memory.dmpFilesize
40KB
-
memory/4008-134-0x0000000009340000-0x00000000093DC000-memory.dmpFilesize
624KB
-
memory/4864-141-0x0000000000000000-mapping.dmp