Resubmissions
14/06/2023, 00:49
230614-a6lm7acd45 1014/06/2023, 00:49
230614-a6ejwacd44 1014/06/2023, 00:21
230614-and6dscd27 10Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 00:49
Behavioral task
behavioral1
Sample
Allergies List and Allowed Substances.numb05151.pdf.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Allergies List and Allowed Substances.numb05151.pdf.scr
Resource
win10v2004-20230220-en
windows10-2004-x64
14 signatures
1800 seconds
General
-
Target
Allergies List and Allowed Substances.numb05151.pdf.scr
-
Size
920.3MB
-
MD5
491c5ac82977262ef24bd22ad312c622
-
SHA1
1f0555370f07e94182059701f63e940429757157
-
SHA256
ea770032c44e773b9c9865d4ff3bfb10f76b003ace1bbfbe45755ffff227e5fe
-
SHA512
a9974fe623a979e12d8493200f36aa4aab5763ea97ed4d5924fb1f579038d686bb10d789d576343ce4ca4c8a4657ed9404b7ffb52f701f6f880eb75e766f6734
-
SSDEEP
393216:rc8yiMPNWZV4nXF12elEA7YKsHES/Sl50l:rcOMPNWTM2elpBtSwW
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral2/memory/3200-133-0x0000000000A00000-0x0000000003366000-memory.dmp dcrat behavioral2/memory/3376-8738-0x0000000000400000-0x00000000004D0000-memory.dmp dcrat -
.NET Reactor proctector 34 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/3200-133-0x0000000000A00000-0x0000000003366000-memory.dmp net_reactor behavioral2/memory/3200-136-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-135-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-138-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-140-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-142-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-144-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-146-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-148-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-150-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-152-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-154-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-156-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-158-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-160-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-162-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-164-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-166-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-168-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-170-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-172-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-174-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-176-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-178-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-180-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-182-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-184-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-186-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-188-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-190-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-192-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-194-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-196-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor behavioral2/memory/3200-198-0x000000001E090000-0x000000001E1E0000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3200 set thread context of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3380 OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1384 taskmgr.exe Token: SeSystemProfilePrivilege 1384 taskmgr.exe Token: SeCreateGlobalPrivilege 1384 taskmgr.exe Token: SeDebugPrivilege 3376 MSBuild.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe -
Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 3380 OpenWith.exe 1080 AcroRd32.exe 1080 AcroRd32.exe 1080 AcroRd32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3380 wrote to memory of 1080 3380 OpenWith.exe 93 PID 3380 wrote to memory of 1080 3380 OpenWith.exe 93 PID 3380 wrote to memory of 1080 3380 OpenWith.exe 93 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95 PID 3200 wrote to memory of 3376 3200 Allergies List and Allowed Substances.numb05151.pdf.scr 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Allergies List and Allowed Substances.numb05151.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Allergies List and Allowed Substances.numb05151.pdf.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1384
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4076
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7737a2b1-6fc2-4642-99fc-97d1aa9f5df5.tmp"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1080
-