c155fef955e84c3105693dd142f5e385ee89fa251fd071f366dc6caa94a34502

Analysis

max time kernel
68s
max time network
32s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
23/06/2023, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
Size 662KB
Sample230623-rwva1sfd39
SHA256 c155fef955e84c3105693dd142f5e385ee89fa251fd071f366dc6caa94a34502
MD5 60b7c382b13d3f69eb22b375c8fd0e06
SHA1 2c01ffaa3448b4c4dbfba0bd614c0b7b6ac318ba
SHA512 3d2679c3ee059ffa13324528dffc83dee2f82a54c77908348931a37928c6459d8e8d7f1d717d9447d874a4e71821432a0aa68ec71c12ce3f275f06608f6cf4a3
SSDEEP 12288:kwokM2iNh4/mNUAEzS22PD77Xuc7O7cpTlrUpphGslpA:13M1D4/QU7e2sH7OAT9OhG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
Token: SeDebugPrivilege	556	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 556	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	26
PID 680 wrote to memory of 556	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	26
PID 680 wrote to memory of 556	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	26
PID 680 wrote to memory of 556	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	26
PID 680 wrote to memory of 660	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	28
PID 680 wrote to memory of 660	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	28
PID 680 wrote to memory of 660	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	28
PID 680 wrote to memory of 660	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	28
PID 680 wrote to memory of 284	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	30
PID 680 wrote to memory of 284	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	30
PID 680 wrote to memory of 284	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	30
PID 680 wrote to memory of 284	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	30
PID 680 wrote to memory of 1640	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	31
PID 680 wrote to memory of 1640	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	31
PID 680 wrote to memory of 1640	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	31
PID 680 wrote to memory of 1640	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	31
PID 680 wrote to memory of 864	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	32
PID 680 wrote to memory of 864	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	32
PID 680 wrote to memory of 864	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	32
PID 680 wrote to memory of 864	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	32
PID 680 wrote to memory of 1380	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	33
PID 680 wrote to memory of 1380	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	33
PID 680 wrote to memory of 1380	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	33
PID 680 wrote to memory of 1380	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	33
PID 680 wrote to memory of 1384	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	34
PID 680 wrote to memory of 1384	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	34
PID 680 wrote to memory of 1384	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	34
PID 680 wrote to memory of 1384	680	DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe	34

C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fLYQfoFLGobkJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fLYQfoFLGobkJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6884.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:660
- C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
  2⤵
  PID:284
- C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
  2⤵
  PID:864
- C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe"
  2⤵
  PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp6884.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6884.tmp
Size 1KB
SHA256 ceab5ad89c607f5bc466e7f802160a3e7684915e503abcdbad0f0d4c790d9dd0
MD5 f9261f2d5421f43f6404a0da0af9fbd3
SHA1 681af067945da6355e77fc474e3781890f0b621c
SHA512 4a5f2e2144f6277b62dd3f01270263f50463401516a543519b3740e467375196829d03c098233b67de4677f74dc3b4e75e4b873b8bc71641b120c1cb999ae71b
MD5 SHA1 SHA512

Submit Download

memory/556-66-0x00000000027A0000-0x00000000027E0000-memory.dmp

Download

memory/680-54-0x00000000003D0000-0x000000000047C000-memory.dmp

Download

memory/680-55-0x0000000005000000-0x0000000005040000-memory.dmp

Download

memory/680-56-0x0000000000520000-0x000000000052C000-memory.dmp

Download

memory/680-57-0x0000000000530000-0x000000000053C000-memory.dmp

Download

memory/680-58-0x0000000004F70000-0x0000000004FDE000-memory.dmp

Download