Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2023 19:51
Static task
static1
Behavioral task
behavioral1
Sample
PDFpower.exe
Resource
win10v2004-20230220-en
General
-
Target
PDFpower.exe
-
Size
1.0MB
-
MD5
fb396e6e8b08308f8d12f2776eda4c85
-
SHA1
69d56902ca69fb3486221301b76c67dcbd2d6bf6
-
SHA256
1bd00252035eadae62c03a8396b5b6e3c355082359714d8f02abd9770cb2ef7e
-
SHA512
a0048c628cdd7b3c1ea607e56c0eb4555f53a82d77a1d3cd0c585ca75c45def76bab64012adad8ddb7bcb7465a87dd0ee365fc2e948ca1517e76b07f4be6a32c
-
SSDEEP
24576:sW9Ytb3SRxqO8m657w6ZBLmkitKqBCjC0PDgM5A6:sWWtbCJVV1BCjB
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
PDFpower.exedescription ioc process File opened (read-only) \??\A: PDFpower.exe File opened (read-only) \??\H: PDFpower.exe File opened (read-only) \??\P: PDFpower.exe File opened (read-only) \??\R: PDFpower.exe File opened (read-only) \??\Q: PDFpower.exe File opened (read-only) \??\T: PDFpower.exe File opened (read-only) \??\Z: PDFpower.exe File opened (read-only) \??\O: PDFpower.exe File opened (read-only) \??\E: PDFpower.exe File opened (read-only) \??\F: PDFpower.exe File opened (read-only) \??\G: PDFpower.exe File opened (read-only) \??\I: PDFpower.exe File opened (read-only) \??\J: PDFpower.exe File opened (read-only) \??\K: PDFpower.exe File opened (read-only) \??\N: PDFpower.exe File opened (read-only) \??\W: PDFpower.exe File opened (read-only) \??\X: PDFpower.exe File opened (read-only) \??\Y: PDFpower.exe File opened (read-only) \??\B: PDFpower.exe File opened (read-only) \??\L: PDFpower.exe File opened (read-only) \??\M: PDFpower.exe File opened (read-only) \??\S: PDFpower.exe File opened (read-only) \??\U: PDFpower.exe File opened (read-only) \??\V: PDFpower.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
PDFpower.exedescription ioc process File opened for modification \??\PhysicalDrive0 PDFpower.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3524 5052 WerFault.exe PDFpower.exe 3140 1544 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PDFpower.exedescription pid process Token: SeDebugPrivilege 5052 PDFpower.exe Token: SeShutdownPrivilege 5052 PDFpower.exe Token: SeCreatePagefilePrivilege 5052 PDFpower.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDFpower.exe"C:\Users\Admin\AppData\Local\Temp\PDFpower.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 33802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5052 -ip 50521⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 1544 -ip 15441⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1544 -s 17481⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
memory/5052-133-0x0000000000C90000-0x0000000000D9C000-memory.dmpFilesize
1.0MB
-
memory/5052-134-0x00000000059F0000-0x0000000005A00000-memory.dmpFilesize
64KB
-
memory/5052-135-0x0000000006220000-0x000000000674C000-memory.dmpFilesize
5.2MB
-
memory/5052-137-0x000000000AB40000-0x000000000ABA6000-memory.dmpFilesize
408KB
-
memory/5052-138-0x00000000059F0000-0x0000000005A00000-memory.dmpFilesize
64KB
-
memory/5052-139-0x00000000059F0000-0x0000000005A00000-memory.dmpFilesize
64KB
-
memory/5052-140-0x000000000BBA0000-0x000000000BBD8000-memory.dmpFilesize
224KB
-
memory/5052-141-0x000000000BCF0000-0x000000000BCFE000-memory.dmpFilesize
56KB
-
memory/5052-144-0x0000000005BF0000-0x0000000005C12000-memory.dmpFilesize
136KB
-
memory/5052-145-0x000000000A6A0000-0x000000000A6A8000-memory.dmpFilesize
32KB
-
memory/5052-146-0x00000000059F0000-0x0000000005A00000-memory.dmpFilesize
64KB