Analysis
-
max time kernel
100s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
Company presentation~pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Company presentation~pdf.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Composition & Quantity~pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Composition & Quantity~pdf.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Inquiry Items~pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Inquiry Items~pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Composition & Quantity~pdf.exe
-
Size
859KB
-
MD5
befba058f69c91a13b001f3d15efa262
-
SHA1
aeebe9b13b160bcb77bca46e5acefbdf214f9e5f
-
SHA256
e469882fa707c3f2f85c8bdd5fe250434f3fa5169ee71f8132dce99296b99629
-
SHA512
13a8df597d4ddf3762731e1c9226845e33ef15595c1e9d6152edf1abfabf5a9695f911a9475f900f1862ba50009c208be613679f9ed51e4a1e698f8eab0e779a
Malware Config
Extracted
Protocol: smtp- Host:
mapi.diplemailsrvr.com - Port:
587 - Username:
[email protected] - Password:
Banachi@1974
Signatures
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Composition & Quantity~pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ybFan = "C:\\FSHLRPTB\\ybFanj\\ybFanjLno.vbs" Composition & Quantity~pdf.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Composition & Quantity~pdf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Composition & Quantity~pdf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Composition & Quantity~pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Composition & Quantity~pdf.exedescription pid process target process PID 3112 set thread context of 4220 3112 Composition & Quantity~pdf.exe InstallUtil.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
InstallUtil.exepid process 4220 InstallUtil.exe 4220 InstallUtil.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Composition & Quantity~pdf.exepid process 3112 Composition & Quantity~pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
InstallUtil.exedescription pid process Token: SeDebugPrivilege 4220 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4220 InstallUtil.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Composition & Quantity~pdf.exeInstallUtil.exedescription pid process target process PID 3112 wrote to memory of 4220 3112 Composition & Quantity~pdf.exe InstallUtil.exe PID 3112 wrote to memory of 4220 3112 Composition & Quantity~pdf.exe InstallUtil.exe PID 3112 wrote to memory of 4220 3112 Composition & Quantity~pdf.exe InstallUtil.exe PID 3112 wrote to memory of 4220 3112 Composition & Quantity~pdf.exe InstallUtil.exe PID 4220 wrote to memory of 4868 4220 InstallUtil.exe REG.exe PID 4220 wrote to memory of 4868 4220 InstallUtil.exe REG.exe PID 4220 wrote to memory of 4868 4220 InstallUtil.exe REG.exe PID 4220 wrote to memory of 3852 4220 InstallUtil.exe netsh.exe PID 4220 wrote to memory of 3852 4220 InstallUtil.exe netsh.exe PID 4220 wrote to memory of 3852 4220 InstallUtil.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Composition & Quantity~pdf.exe"C:\Users\Admin\AppData\Local\Temp\Composition & Quantity~pdf.exe"1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"C:\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3112-130-0x0000000000DF0000-0x0000000000ECC000-memory.dmpFilesize
880KB
-
memory/3112-131-0x0000000005E90000-0x0000000006434000-memory.dmpFilesize
5.6MB
-
memory/3852-135-0x0000000000000000-mapping.dmp
-
memory/4220-132-0x0000000000000000-mapping.dmp
-
memory/4220-133-0x00000000751C0000-0x0000000075771000-memory.dmpFilesize
5.7MB
-
memory/4868-134-0x0000000000000000-mapping.dmp