b2e071ddc965abc1ec26939b320ab57e58d06e03dfccf97b6a3e22370dbc15cd

Analysis

max time kernel
246s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Advanced.PDF.Password.Recovery.v5.0.0-Crack/APDFPR_setup.exe
Size

40.1MB
MD5

c429458ccc6d8ff30eded905e535a4a5
SHA1

1082d198318015d82e035d1e4ea6f687605a6123
SHA256

d6e9a4a04a0b7bc0a58f616435fc609e3bf78111111d2fca613ddc65b0c2f891
SHA512

b35b02347ecd930b183c49c42c4adde4543b3a473d553ff0492473df44b61f68bdc3a7db59d6dd71492a369c119fc3831056bb725fa9d892df9a6448d27cee62
SSDEEP

393216:HEuRgRZ0NgwD+D0cl7EqiMl1KB3HxGhpFTHa0I8VTy21XKZBh4lRe:vRaZ27Dumqf43xGh20zNy82B2Re

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

APDFPR_setup.exe

pid process

1228 APDFPR_setup.exe

pid	process
1228	APDFPR_setup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

APDFPR_setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	APDFPR_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\APDFPR = "C:\\Users\\Public\\Oywt\\Ekuk.exe /APDFPR"	APDFPR_setup.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

APDFPR_setup.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	APDFPR_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	APDFPR_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\International\CpMRU	APDFPR_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	APDFPR_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	APDFPR_setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

APDFPR_setup.exe

pid process

2736 APDFPR_setup.exe
2736 APDFPR_setup.exe

pid	process
2736	APDFPR_setup.exe
2736	APDFPR_setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

APDFPR_setup.exe

description	pid	process	target process
PID 2736 wrote to memory of 1228	2736	APDFPR_setup.exe	APDFPR_setup.exe
PID 2736 wrote to memory of 1228	2736	APDFPR_setup.exe	APDFPR_setup.exe
PID 2736 wrote to memory of 1228	2736	APDFPR_setup.exe	APDFPR_setup.exe

C:\Users\Admin\AppData\Local\Temp\Advanced.PDF.Password.Recovery.v5.0.0-Crack\APDFPR_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Advanced.PDF.Password.Recovery.v5.0.0-Crack\APDFPR_setup.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Iyxmd674\APDFPR_setup.exe
  C:\Users\Admin\AppData\Local\Temp\Iyxmd674\APDFPR_setup.exe
  2⤵
  - Executes dropped EXE
  PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Iyxmd674\APDFPR_setup.exe

Filesize
1.5MB

MD5
2b20f0f94ffa0836705d0a8004347b4e

SHA1
57b1b063ba8a960364869d71db3703f0f76402a2

SHA256
ec6471c8a22e700d0253a70a7bd22b1cbfe494b903143d428449eb6e03b59b0c

SHA512
015bdfcbf2e40bb63ec7063962d894fe3073c66141770dcbabd828361f9208b2a36ae8294f6208c9420ce37526b72895d22eb2f305d077bd9cc8056084e1dc67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iyxmd674\APDFPR_setup.exe

Filesize
1.5MB

MD5
2b20f0f94ffa0836705d0a8004347b4e

SHA1
57b1b063ba8a960364869d71db3703f0f76402a2

SHA256
ec6471c8a22e700d0253a70a7bd22b1cbfe494b903143d428449eb6e03b59b0c

SHA512
015bdfcbf2e40bb63ec7063962d894fe3073c66141770dcbabd828361f9208b2a36ae8294f6208c9420ce37526b72895d22eb2f305d077bd9cc8056084e1dc67

Download Submit
memory/1228-132-0x0000000000000000-mapping.dmp

Download
memory/1228-135-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1228-136-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download