3d73c770ccf593e83a8e324747bf9bfb0bb5f8645993492ee6a37ddec1816309

Analysis

max time kernel
54s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Size

284KB
MD5

5227780e4555ca60025d107d5baea9dd
SHA1

73caffd3824697f8686250ef6e6c4ac12ab39252
SHA256

a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
SHA512

b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
SSDEEP

6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yloxxvsc.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\yloxxvsc.exe\""	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
2592	Explorer.EXE
2592	Explorer.EXE
2592	Explorer.EXE
2592	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Token: SeDebugPrivilege	2592	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1148	4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4492 wrote to memory of 1148	4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4492 wrote to memory of 1148	4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4492 wrote to memory of 2592	4492	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	71
PID 2592 wrote to memory of 2484	2592	Explorer.EXE	74
PID 2592 wrote to memory of 2504	2592	Explorer.EXE	73

C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7140~1.BAT"
  2⤵
  PID:1148

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2504

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-135-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmp

Filesize
64KB

Download
memory/4492-132-0x0000000001680000-0x000000000168E000-memory.dmp

Filesize
56KB

Download
memory/4492-133-0x0000000000150000-0x000000000019A000-memory.dmp

Filesize
296KB

Download