Analysis
-
max time kernel
143s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-03-2023 09:27
Static task
static1
Behavioral task
behavioral1
Sample
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe
Resource
win10v2004-20230220-en
General
-
Target
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe
-
Size
10.8MB
-
MD5
3996e7eb17533f55690da2b84ecab7c2
-
SHA1
2289a4e62cbf99fe87e0e3688123a6afad8f927e
-
SHA256
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0
-
SHA512
f737071daf01ca8aff070e8f5c6d14566ee5af945aae0af9bd825112aef21e58a0ff800550b7764e52f28b4112607d1604dd113a881ffde4e31bbbd89c676ca2
-
SSDEEP
196608:Lg3Y8UpYCcME8DYz/rJzofv943JES94ND7/iqLFVziAlBwKkZY8LMp5:Lgo8BCc3KYzTJzofV43JEd7DzDBwKgo5
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\pdfspr.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\pdfspr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
PDFShaper.exepid process 1696 PDFShaper.exe -
Loads dropped DLL 2 IoCs
Processes:
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exePDFShaper.exepid process 1724 2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe 1696 PDFShaper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 33 IoCs
Processes:
PDFShaper.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\0\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\87" PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\VersionIndependentProgID PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7} PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\InprocServer32\ PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0 PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\VersionIndependentProgID\ = "Psisdecd.PBDA" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\InprocServer32\ = "C:\\Windows\\SysWOW64\\psisdecd.dll" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\0\win32\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\Version\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\ PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\Version PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\0 PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\Version\ = "1.0" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\FLAGS\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\FLAGS\ = "0" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\TypeLib\ = "{4D64281D-7A0F-C072-6307-9425FB102187}" PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187} PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\ PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\0\win32 PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\HELPDIR\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\TypeLib\ PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\ProgID PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\FLAGS PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\HELPDIR PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\VersionIndependentProgID\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\ProgID\ PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\ProgID\ = "Psisdecd.PBDA.1" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D64281D-7A0F-C072-6307-9425FB102187}\1.0\ = "Groove CustomerServiceMgr 1.0 Type Library" PDFShaper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\ = "Vajama Exozigsi class" PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\InprocServer32 PDFShaper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EBBCEBF-B2D8-42D8-BA8A-711F999EF4B7}\TypeLib PDFShaper.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
PDFShaper.exepid process 1696 PDFShaper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PDFShaper.exepid process 1696 PDFShaper.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exedescription pid process target process PID 1724 wrote to memory of 1696 1724 2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe PDFShaper.exe PID 1724 wrote to memory of 1696 1724 2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe PDFShaper.exe PID 1724 wrote to memory of 1696 1724 2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe PDFShaper.exe PID 1724 wrote to memory of 1696 1724 2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe PDFShaper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe"C:\Users\Admin\AppData\Local\Temp\2d2f1012f43bc35fcd7249fb77633e38438d633e5d8b731ef3182670f02a83b0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\PDFShaper.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\PDFShaper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\Chinese.lngFilesize
14KB
MD5ca8c4f1166b5ac32316839b37af29a92
SHA1e36ed0f83ddf057415b2f0c060ddd8f330efc9c2
SHA2565dc6b984d188dc50a5cf30a16748e7b7d3a63ce1c5ed3efb8b412bbda27b2b10
SHA512c4eea1a2deb9039a381dcd0c9ba58fe9967f48d00e4637e96c08e6c27d38153b27df2070e1686a5bc7f0cf2ad6c6dcf0a6ed2ca209d51e7071141c4965cd8f33
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\PDFShaper.exeFilesize
8.9MB
MD5dc61074e15febd61fc327a71fd5fd828
SHA1dfbeb8f183890361de4a83aaf7b4ed5990db220d
SHA25628d8cdb09a23eb63f0c7771b33b28c824e70c22f61732a496d1ee41704e67a10
SHA5127fe2444819cfabcb711e5f09ab40db2dfc129f52066b1ce2c572708c30651391f21b7b5de758a0b7c3207e94d67795363d768aa4c73b6b5421d3158dbd2e14d4
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\PDFShaper.exeFilesize
8.9MB
MD5dc61074e15febd61fc327a71fd5fd828
SHA1dfbeb8f183890361de4a83aaf7b4ed5990db220d
SHA25628d8cdb09a23eb63f0c7771b33b28c824e70c22f61732a496d1ee41704e67a10
SHA5127fe2444819cfabcb711e5f09ab40db2dfc129f52066b1ce2c572708c30651391f21b7b5de758a0b7c3207e94d67795363d768aa4c73b6b5421d3158dbd2e14d4
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\pdfspr.dllFilesize
540KB
MD5a7ac79d567b99c4ffe76ff5e8c3eddf6
SHA1d23cd4f3efd015dac51cd74e94e27fd82d6ccee5
SHA2564970fc58e635873136d17cb8d34d8ee4cab40e82984fcf7e5f3d54da2a810928
SHA512063eccdd21a0810573719285a17484b5f7c3704b219829b0ee0d55ffb6d94643e94bdd4aad06e5e536c4d5173313da9f8b05e2c00cd43204298bdd3371e78c04
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\PDFShaper.exeFilesize
8.9MB
MD5dc61074e15febd61fc327a71fd5fd828
SHA1dfbeb8f183890361de4a83aaf7b4ed5990db220d
SHA25628d8cdb09a23eb63f0c7771b33b28c824e70c22f61732a496d1ee41704e67a10
SHA5127fe2444819cfabcb711e5f09ab40db2dfc129f52066b1ce2c572708c30651391f21b7b5de758a0b7c3207e94d67795363d768aa4c73b6b5421d3158dbd2e14d4
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PDFShaper\pdfspr.dllFilesize
540KB
MD5a7ac79d567b99c4ffe76ff5e8c3eddf6
SHA1d23cd4f3efd015dac51cd74e94e27fd82d6ccee5
SHA2564970fc58e635873136d17cb8d34d8ee4cab40e82984fcf7e5f3d54da2a810928
SHA512063eccdd21a0810573719285a17484b5f7c3704b219829b0ee0d55ffb6d94643e94bdd4aad06e5e536c4d5173313da9f8b05e2c00cd43204298bdd3371e78c04
-
memory/1696-100-0x00000000048F0000-0x0000000004950000-memory.dmpFilesize
384KB
-
memory/1696-99-0x0000000004770000-0x0000000004886000-memory.dmpFilesize
1.1MB
-
memory/1696-95-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1696-101-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/1696-102-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/1696-103-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1696-104-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/1696-106-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/1696-105-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/1696-107-0x0000000000400000-0x0000000000EB6000-memory.dmpFilesize
10.7MB
-
memory/1696-108-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1696-110-0x00000000048F0000-0x0000000004950000-memory.dmpFilesize
384KB