Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:29
Static task
static1
Behavioral task
behavioral1
Sample
EMECA20_GeneralBrochureEN_web_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
EMECA20_GeneralBrochureEN_web_pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
EMECA20_GeneralBrochureEN_web_pdf.exe
-
Size
981KB
-
MD5
0816345b69321795af4a24159d3545b7
-
SHA1
4b743df38e5f214bf85b85c95851bf75d08683a1
-
SHA256
f79b985c1bf0b6708864ec45d12917c2e130dc53408b648b893179874f8e4b97
-
SHA512
5ad6e41c75500c95b40f5866f265a927e252ec9ed8adc59c003180efd7627f5fff0c276d3b93ffd77263de8008125152db2ce8f657da993bb88a31249298e7b6
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7 = "C:\\Users\\Admin\\AppData\\Roaming\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 276 notepad.exe -
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" EMECA20_GeneralBrochureEN_web_pdf.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7 = "C:\\Users\\Admin\\AppData\\Roaming\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7 = "C:\\Users\\Admin\\AppData\\Roaming\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7\\L5Y8V7P1-C2B7-Q0N6-B1K7-L222R0D0G5H7.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" EMECA20_GeneralBrochureEN_web_pdf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exeEMECA20_GeneralBrochureEN_web_pdf.exedescription pid process target process PID 536 set thread context of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 1292 set thread context of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exeEMECA20_GeneralBrochureEN_web_pdf.exepid process 536 EMECA20_GeneralBrochureEN_web_pdf.exe 536 EMECA20_GeneralBrochureEN_web_pdf.exe 536 EMECA20_GeneralBrochureEN_web_pdf.exe 536 EMECA20_GeneralBrochureEN_web_pdf.exe 1292 EMECA20_GeneralBrochureEN_web_pdf.exe 1292 EMECA20_GeneralBrochureEN_web_pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exeiexplore.exedescription pid process Token: SeDebugPrivilege 536 EMECA20_GeneralBrochureEN_web_pdf.exe Token: SeDebugPrivilege 892 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exeiexplore.exepid process 1292 EMECA20_GeneralBrochureEN_web_pdf.exe 892 iexplore.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exeEMECA20_GeneralBrochureEN_web_pdf.exeiexplore.exedescription pid process target process PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 536 wrote to memory of 1292 536 EMECA20_GeneralBrochureEN_web_pdf.exe EMECA20_GeneralBrochureEN_web_pdf.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 1292 wrote to memory of 892 1292 EMECA20_GeneralBrochureEN_web_pdf.exe iexplore.exe PID 892 wrote to memory of 276 892 iexplore.exe notepad.exe PID 892 wrote to memory of 276 892 iexplore.exe notepad.exe PID 892 wrote to memory of 276 892 iexplore.exe notepad.exe PID 892 wrote to memory of 276 892 iexplore.exe notepad.exe PID 892 wrote to memory of 276 892 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
EMECA20_GeneralBrochureEN_web_pdf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" EMECA20_GeneralBrochureEN_web_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EMECA20_GeneralBrochureEN_web_pdf.exe"C:\Users\Admin\AppData\Local\Temp\EMECA20_GeneralBrochureEN_web_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EMECA20_GeneralBrochureEN_web_pdf.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\EMECA20_GeneralBrochureEN_web_pdf.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-70-0x0000000000000000-mapping.dmp
-
memory/276-71-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/536-54-0x0000000000E00000-0x0000000000EFA000-memory.dmpFilesize
1000KB
-
memory/536-55-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/536-56-0x0000000000A70000-0x0000000000AC6000-memory.dmpFilesize
344KB
-
memory/536-57-0x0000000000B00000-0x0000000000B30000-memory.dmpFilesize
192KB
-
memory/1292-58-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1292-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1292-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1292-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1292-64-0x00000000004010B8-mapping.dmp
-
memory/1292-69-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB