Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 09:14
Static task
static1
Behavioral task
behavioral1
Sample
194388494000_pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
194388494000_pdf.exe
Resource
win10v2004-20221111-en
General
-
Target
194388494000_pdf.exe
-
Size
10.0MB
-
MD5
694463cf1660b3ae188120328a1b93f8
-
SHA1
90389ff9d5817b730e2d358d9fbc71b4a2942670
-
SHA256
f1c9f70b73a3b62f0426336303fdaa110110600dfc56893dbd000837b58f41d0
-
SHA512
c219164e256ae715823c96e47bbc00b682aeeecd80a17c150e52e0329639135cd59ca5ceab5f84406c808b81f9ece291eefd0cdecb02baa1de517ca48d876307
-
SSDEEP
96:2GpKgeeUuHIMSz9FVLojDU7Rk0QCh8pbkPIjyxNezNtp:E8ToMqNLojD2xapQPIjo43
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
194388494000_pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 194388494000_pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
194388494000_pdf.exedescription pid process target process PID 3768 set thread context of 3668 3768 194388494000_pdf.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2248 powershell.exe 2248 powershell.exe 4268 powershell.exe 4268 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
194388494000_pdf.exepowershell.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3768 194388494000_pdf.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 4268 powershell.exe Token: SeDebugPrivilege 3668 RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
194388494000_pdf.execmd.exedescription pid process target process PID 3768 wrote to memory of 2248 3768 194388494000_pdf.exe powershell.exe PID 3768 wrote to memory of 2248 3768 194388494000_pdf.exe powershell.exe PID 3768 wrote to memory of 2248 3768 194388494000_pdf.exe powershell.exe PID 3768 wrote to memory of 1840 3768 194388494000_pdf.exe cmd.exe PID 3768 wrote to memory of 1840 3768 194388494000_pdf.exe cmd.exe PID 3768 wrote to memory of 1840 3768 194388494000_pdf.exe cmd.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 3768 wrote to memory of 3668 3768 194388494000_pdf.exe RegAsm.exe PID 1840 wrote to memory of 4268 1840 cmd.exe powershell.exe PID 1840 wrote to memory of 4268 1840 cmd.exe powershell.exe PID 1840 wrote to memory of 4268 1840 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\194388494000_pdf.exe"C:\Users\Admin\AppData\Local\Temp\194388494000_pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD538f5f45d25bdb2c183b58aaa0a264659
SHA1e27bdcdeb58638961293bd2c4057dfc828d29161
SHA256484355fb705590d4fd258681500a3babd45e2cc7dff63782596e41f3c521d1f4
SHA5120dc0284f81bee59da18e0750f633de2a2f561305981001efacb639e489bc22fdd89a2d908c715b98787fe27bfa93e446b0a29c98ec4ada4179198699b7a91d58
-
memory/1840-144-0x0000000000000000-mapping.dmp
-
memory/2248-136-0x0000000000000000-mapping.dmp
-
memory/2248-137-0x0000000002E10000-0x0000000002E46000-memory.dmpFilesize
216KB
-
memory/2248-138-0x0000000005A50000-0x0000000006078000-memory.dmpFilesize
6.2MB
-
memory/2248-139-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/2248-140-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/2248-141-0x0000000006740000-0x000000000675E000-memory.dmpFilesize
120KB
-
memory/2248-142-0x0000000007D90000-0x000000000840A000-memory.dmpFilesize
6.5MB
-
memory/2248-143-0x0000000006C20000-0x0000000006C3A000-memory.dmpFilesize
104KB
-
memory/3668-146-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/3668-145-0x0000000000000000-mapping.dmp
-
memory/3768-133-0x0000000006200000-0x00000000067A4000-memory.dmpFilesize
5.6MB
-
memory/3768-132-0x0000000000080000-0x0000000000088000-memory.dmpFilesize
32KB
-
memory/3768-135-0x0000000005EE0000-0x0000000005F02000-memory.dmpFilesize
136KB
-
memory/3768-134-0x0000000005D50000-0x0000000005DE2000-memory.dmpFilesize
584KB
-
memory/4268-151-0x0000000007470000-0x00000000074A2000-memory.dmpFilesize
200KB
-
memory/4268-147-0x0000000000000000-mapping.dmp
-
memory/4268-152-0x0000000075410000-0x000000007545C000-memory.dmpFilesize
304KB
-
memory/4268-153-0x0000000007430000-0x000000000744E000-memory.dmpFilesize
120KB
-
memory/4268-154-0x0000000007880000-0x000000000788A000-memory.dmpFilesize
40KB
-
memory/4268-155-0x0000000007AC0000-0x0000000007B56000-memory.dmpFilesize
600KB
-
memory/4268-156-0x0000000006330000-0x000000000633E000-memory.dmpFilesize
56KB
-
memory/4268-157-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/4268-158-0x0000000007A00000-0x0000000007A08000-memory.dmpFilesize
32KB