4628836ee082fa27270656dfa61109178e78fde1e55364b00c27ad10d77ee6ae

General

Target

izvod plačila pdf (613KB).exe
Size

1.2MB
MD5

bfebe3347722d3c30d47ee8ccfc7a990
SHA1

80d10707a7dbdfeacb0a431c9bfbf34a58cf33ec
SHA256

4628836ee082fa27270656dfa61109178e78fde1e55364b00c27ad10d77ee6ae
SHA512

6ea08e4a4be32d56ff5450b9a61aeeccba3fef4114dada88565fc91886f96642d1237dfb7d419d6a7a716568516ae14bcb9c90dc7822a5b545f04ecbcba14087
SSDEEP

24576:GnrnaS36mDrycFwbDFEsxxJHoVYdX1QCosRa9ZH6h7iuWsDcWI:8F364ebDFxxJQC1QCosR26Au/D

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

izvod plačila pdf (613KB).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	izvod plačila pdf (613KB).exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4832 schtasks.exe

pid	process
4832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

izvod plačila pdf (613KB).exepowershell.exe

pid	process
4284	izvod plačila pdf (613KB).exe
3608	powershell.exe
3608	powershell.exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
4284	izvod plačila pdf (613KB).exe
3608	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

izvod plačila pdf (613KB).exepowershell.exe

description pid process

Token: SeDebugPrivilege 4284 izvod plačila pdf (613KB).exe
Token: SeDebugPrivilege 3608 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4284	izvod plačila pdf (613KB).exe
Token: SeDebugPrivilege	3608	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

izvod plačila pdf (613KB).exe

description	pid	process	target process
PID 4284 wrote to memory of 3608	4284	izvod plačila pdf (613KB).exe	powershell.exe
PID 4284 wrote to memory of 3608	4284	izvod plačila pdf (613KB).exe	powershell.exe
PID 4284 wrote to memory of 3608	4284	izvod plačila pdf (613KB).exe	powershell.exe
PID 4284 wrote to memory of 4832	4284	izvod plačila pdf (613KB).exe	schtasks.exe
PID 4284 wrote to memory of 4832	4284	izvod plačila pdf (613KB).exe	schtasks.exe
PID 4284 wrote to memory of 4832	4284	izvod plačila pdf (613KB).exe	schtasks.exe
PID 4284 wrote to memory of 5088	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 5088	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 5088	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 2216	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 2216	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 2216	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 488	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 488	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 488	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 3048	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 3048	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 3048	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 4372	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 4372	4284	izvod plačila pdf (613KB).exe	vbc.exe
PID 4284 wrote to memory of 4372	4284	izvod plačila pdf (613KB).exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\izvod plačila pdf (613KB).exe
"C:\Users\Admin\AppData\Local\Temp\izvod plačila pdf (613KB).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CiGOFVCodFJd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CiGOFVCodFJd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp35A6.tmp"
2⤵
- Creates scheduled task(s)
PID:4832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:5088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp35A6.tmp
Filesize
1KB

MD5
3df64130298aced4e65fd74823742027

SHA1
2bae977f8ab3078f3b764e58ec9ec257429596f5

SHA256
b67a98648657f999e91b1d2f7660b5b416fc309f3d5a4679a0b316c9a1775325

SHA512
cff603f52f58e6b1387b21a96f9927bc9d3063b90818953d9274af20de10512298d1c68e86f38093636cfd17e076d386093f85c34b1afcf0da5cd2d47b78f1d0

Download Submit
memory/488-145-0x0000000000000000-mapping.dmp

Download
memory/2216-144-0x0000000000000000-mapping.dmp

Download
memory/3048-146-0x0000000000000000-mapping.dmp

Download
memory/3608-153-0x0000000006040000-0x000000000605E000-memory.dmp

Filesize
120KB

Download
memory/3608-157-0x0000000007000000-0x0000000007096000-memory.dmp

Filesize
600KB

Download
memory/3608-160-0x00000000070A0000-0x00000000070A8000-memory.dmp

Filesize
32KB

Download
memory/3608-139-0x0000000000CC0000-0x0000000000CF6000-memory.dmp

Filesize
216KB

Download
memory/3608-159-0x00000000070C0000-0x00000000070DA000-memory.dmp

Filesize
104KB

Download
memory/3608-141-0x0000000004DB0000-0x00000000053D8000-memory.dmp

Filesize
6.2MB

Download
memory/3608-143-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

Filesize
136KB

Download
memory/3608-137-0x0000000000000000-mapping.dmp

Download
memory/3608-158-0x0000000006FB0000-0x0000000006FBE000-memory.dmp

Filesize
56KB

Download
memory/3608-154-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Filesize
6.5MB

Download
memory/3608-156-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Filesize
40KB

Download
memory/3608-148-0x0000000004BD0000-0x0000000004C36000-memory.dmp

Filesize
408KB

Download
memory/3608-149-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/3608-155-0x0000000006D80000-0x0000000006D9A000-memory.dmp

Filesize
104KB

Download
memory/3608-150-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Filesize
120KB

Download
memory/3608-151-0x0000000006A30000-0x0000000006A62000-memory.dmp

Filesize
200KB

Download
memory/3608-152-0x00000000750D0000-0x000000007511C000-memory.dmp

Filesize
304KB

Download
memory/4284-135-0x0000000005720000-0x000000000572A000-memory.dmp

Filesize
40KB

Download
memory/4284-132-0x0000000000C70000-0x0000000000D9E000-memory.dmp

Filesize
1.2MB

Download
memory/4284-133-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/4284-134-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/4284-136-0x0000000009120000-0x00000000091BC000-memory.dmp

Filesize
624KB

Download
memory/4372-147-0x0000000000000000-mapping.dmp

Download
memory/4832-138-0x0000000000000000-mapping.dmp

Download
memory/5088-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads