05b37fed91a4de9d7442349ccd379719c3b9dd9b220d28b702adfb25f05d010c

General

Target

scan00465.pdf.exe
Size

1.1MB
MD5

6518afc08223493b4e6303248a6c70d0
SHA1

e0b419b7f13e1271f32b46551febed8d5168f328
SHA256

f98d355a4771e886220488b0bffa005af9769480cde5aad275d4166c2f9b2e48
SHA512

85a3956cccf90116220b6cd6bc63898806bc703589d5e5d7ccc4bfc13a0908ea3538d4b5dbc7af075e11c016f18029e11a7c510ed1af393f4e1ef9244cc71813

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

scan00465.pdf.exescan00465.pdf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	scan00465.pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	scan00465.pdf.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

scan00465.pdf.exe

description pid process target process

PID 3172 set thread context of 4196 3172 scan00465.pdf.exe scan00465.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

796 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

scan00465.pdf.exe

pid process

3172 scan00465.pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

scan00465.pdf.exescan00465.pdf.exe

description pid process

Token: SeDebugPrivilege 3172 scan00465.pdf.exe
Token: SeDebugPrivilege 4196 scan00465.pdf.exe

flow	ioc
48	api.ipify.org

description	pid	process	target process
PID 3172 set thread context of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe

pid	process
796	schtasks.exe

pid	process
3172	scan00465.pdf.exe

description	pid	process
Token: SeDebugPrivilege	3172	scan00465.pdf.exe
Token: SeDebugPrivilege	4196	scan00465.pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

scan00465.pdf.exe

description	pid	process	target process
PID 3172 wrote to memory of 796	3172	scan00465.pdf.exe	schtasks.exe
PID 3172 wrote to memory of 796	3172	scan00465.pdf.exe	schtasks.exe
PID 3172 wrote to memory of 796	3172	scan00465.pdf.exe	schtasks.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe
PID 3172 wrote to memory of 4196	3172	scan00465.pdf.exe	scan00465.pdf.exe

C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lxKUUSvBoqI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89AD.tmp"
2⤵
- Creates scheduled task(s)
PID:796

C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\scan00465.pdf.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp89AD.tmp
Filesize
1KB

MD5
224bc5d6654a36924e820b453366244b

SHA1
1074da8ce17dea1eba7100d33a4ac7747ab9fb40

SHA256
01cb122d9844dbc4e8a5881e0e53ddd00a113a4e85d354200131fc73cd94a7df

SHA512
6cd97351b0499b0c7a4d85b8f8bb84ebafbe057ec5c3f76b191ebf4ff790f85e241bc7985c917ac59ff8a928086e78c2a0332d7fc7d23d9a3dd7baeb80f44515

Download Submit
memory/796-135-0x0000000000000000-mapping.dmp

Download
memory/3172-131-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/3172-132-0x0000000004DB0000-0x0000000004E42000-memory.dmp

Filesize
584KB

Download
memory/3172-133-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/3172-134-0x0000000008530000-0x00000000085CC000-memory.dmp

Filesize
624KB

Download
memory/3172-130-0x00000000002A0000-0x00000000003C0000-memory.dmp

Filesize
1.1MB

Download
memory/4196-161-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-171-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-141-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-143-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-153-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-155-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-157-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-159-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-137-0x0000000000000000-mapping.dmp

Download
memory/4196-163-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-165-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-167-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-169-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-138-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-173-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-175-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-177-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-179-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-181-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-183-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-185-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-189-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-191-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-193-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-195-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-199-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-201-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4196-650-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads