Analysis
-
max time kernel
62s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 06:24
Static task
static1
Behavioral task
behavioral1
Sample
SOA & UNPAID INVOICES.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SOA & UNPAID INVOICES.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
SOA & UNPAID INVOICES.pdf.exe
-
Size
670KB
-
MD5
b6e3ea3ca41fadf4b2d8e8c4547bbb3b
-
SHA1
dbd634b213e1dba07b9d3cb4b880d2db158818f7
-
SHA256
a9e823696e9c25dda75eae39878e430238e78b379bb51a0658d8fd93bd2c604d
-
SHA512
ecc6d1b83eada0530986c3357a56b51253686bc3db150601daf8cca0dce4db0349a4ec75bb702c808aee2c5618bdb120d8ba249b20fa9426d6983f7d4516fa29
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
SOA & UNPAID INVOICES.pdf.exepowershell.exepid process 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1364 SOA & UNPAID INVOICES.pdf.exe 1796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SOA & UNPAID INVOICES.pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 1364 SOA & UNPAID INVOICES.pdf.exe Token: SeDebugPrivilege 1796 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
SOA & UNPAID INVOICES.pdf.exedescription pid process target process PID 1364 wrote to memory of 1796 1364 SOA & UNPAID INVOICES.pdf.exe powershell.exe PID 1364 wrote to memory of 1796 1364 SOA & UNPAID INVOICES.pdf.exe powershell.exe PID 1364 wrote to memory of 1796 1364 SOA & UNPAID INVOICES.pdf.exe powershell.exe PID 1364 wrote to memory of 1796 1364 SOA & UNPAID INVOICES.pdf.exe powershell.exe PID 1364 wrote to memory of 1320 1364 SOA & UNPAID INVOICES.pdf.exe schtasks.exe PID 1364 wrote to memory of 1320 1364 SOA & UNPAID INVOICES.pdf.exe schtasks.exe PID 1364 wrote to memory of 1320 1364 SOA & UNPAID INVOICES.pdf.exe schtasks.exe PID 1364 wrote to memory of 1320 1364 SOA & UNPAID INVOICES.pdf.exe schtasks.exe PID 1364 wrote to memory of 904 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 904 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 904 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 904 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 900 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 900 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 900 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 900 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 1816 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 1816 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 1816 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 1816 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 868 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 868 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 868 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 868 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 360 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 360 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 360 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe PID 1364 wrote to memory of 360 1364 SOA & UNPAID INVOICES.pdf.exe SOA & UNPAID INVOICES.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TsWISurTqG.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TsWISurTqG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB2C.tmp"2⤵
- Creates scheduled task(s)
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"2⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"2⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"2⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"2⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"2⤵PID:360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCB2C.tmpFilesize
1KB
MD5c7494b0d5ba2cfe232a21d899cfe7c49
SHA13f4e20c5bac95205131bba001269115abb0a28c3
SHA256d6e09cfede40b0ac815b131a0a65373af786d73a6a544ab3fbe417c71f6d19c9
SHA51211c6975d502bdc58d83cf667e13aa4adaee2bccc949ba5f9544b7c91b689abbb26eef04595de969e41dea8fb03e6160d58de7fe8265ddeab6870bbf2681d50de
-
memory/1320-59-0x0000000000000000-mapping.dmp
-
memory/1364-54-0x0000000000390000-0x000000000043E000-memory.dmpFilesize
696KB
-
memory/1364-55-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/1364-56-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/1364-57-0x0000000005E50000-0x0000000005ED4000-memory.dmpFilesize
528KB
-
memory/1364-62-0x00000000047A0000-0x00000000047C8000-memory.dmpFilesize
160KB
-
memory/1796-58-0x0000000000000000-mapping.dmp
-
memory/1796-63-0x000000006F120000-0x000000006F6CB000-memory.dmpFilesize
5.7MB