Analysis
-
max time kernel
151s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:35
Static task
static1
Behavioral task
behavioral1
Sample
Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe
Resource
win10v2004-20221111-en
General
-
Target
Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe
-
Size
348KB
-
MD5
bbf1bd69844f4620fd24564c2d87b37b
-
SHA1
4c31462b2e603aaab1d31974bb88c13675a95906
-
SHA256
1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
-
SHA512
4ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e
-
SSDEEP
3072:Qs2cEhmHKgLksCxnUmakgGgC+YdSnu+T9T1c/SzBRby1SO6MP58XQWApvoL7Pd0f:Qs2A0leQUu+5Zc/YSUaC2vG0UF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
msconfiQg.exepid process 3660 msconfiQg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
msconfiQg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" msconfiQg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\msconfiQg.exe" msconfiQg.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msconfiQg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" msconfiQg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msconfiQg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
msconfiQg.exepid process 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe 3660 msconfiQg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msconfiQg.exedescription pid process Token: SeDebugPrivilege 3660 msconfiQg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msconfiQg.exepid process 3660 msconfiQg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exedescription pid process target process PID 1312 wrote to memory of 3660 1312 Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe msconfiQg.exe PID 1312 wrote to memory of 3660 1312 Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe msconfiQg.exe PID 1312 wrote to memory of 3660 1312 Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe msconfiQg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe"C:\Users\Admin\AppData\Local\Temp\Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ______________.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Roaming\msconfiQg.exe"C:\Users\Admin\AppData\Roaming\msconfiQg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
MD5bbf1bd69844f4620fd24564c2d87b37b
SHA14c31462b2e603aaab1d31974bb88c13675a95906
SHA2561b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
SHA5124ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e
-
Filesize
348KB
MD5bbf1bd69844f4620fd24564c2d87b37b
SHA14c31462b2e603aaab1d31974bb88c13675a95906
SHA2561b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
SHA5124ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e