ef2d17ea4829813cf2ce706c8095a6153d3f21b78bc9bae968ad35b3c1d2a971

Analysis

max time kernel
40s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order.2087.pdf.exe
Size 562KB
Sample230712-gvcpgacb39
SHA256 ef2d17ea4829813cf2ce706c8095a6153d3f21b78bc9bae968ad35b3c1d2a971
MD5 eeddf636d35ee32cf3f540481b41a2ae
SHA1 27e37328890f459e542ad601fc9818e086c8380f
SHA512 0ad987d76f8ed719ea4126959442f451725bcce388d5e3a0a63d9d206d5d01ec63ac8cc7a0b201212849f8cb96fbd4d509762ba41c3dfe4df9f3bf98e6bfc718
SSDEEP 6144:CmEFcsfOqeazCR9aYWNPJMv1ML4eRipj7r0ei0J3jk2E7cPKiFNwcEjHlkFA2oAl:mP7NPJrir9djkZiHwcKFOUu9aGInkf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2260	New Order.2087.pdf.exe
2972	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	New Order.2087.pdf.exe
Token: SeDebugPrivilege	2972	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2972	2260	New Order.2087.pdf.exe	29
PID 2260 wrote to memory of 2972	2260	New Order.2087.pdf.exe	29
PID 2260 wrote to memory of 2972	2260	New Order.2087.pdf.exe	29
PID 2260 wrote to memory of 2972	2260	New Order.2087.pdf.exe	29
PID 2260 wrote to memory of 2976	2260	New Order.2087.pdf.exe	31
PID 2260 wrote to memory of 2976	2260	New Order.2087.pdf.exe	31
PID 2260 wrote to memory of 2976	2260	New Order.2087.pdf.exe	31
PID 2260 wrote to memory of 2976	2260	New Order.2087.pdf.exe	31
PID 2260 wrote to memory of 2108	2260	New Order.2087.pdf.exe	33
PID 2260 wrote to memory of 2108	2260	New Order.2087.pdf.exe	33
PID 2260 wrote to memory of 2108	2260	New Order.2087.pdf.exe	33
PID 2260 wrote to memory of 2108	2260	New Order.2087.pdf.exe	33
PID 2260 wrote to memory of 1664	2260	New Order.2087.pdf.exe	34
PID 2260 wrote to memory of 1664	2260	New Order.2087.pdf.exe	34
PID 2260 wrote to memory of 1664	2260	New Order.2087.pdf.exe	34
PID 2260 wrote to memory of 1664	2260	New Order.2087.pdf.exe	34
PID 2260 wrote to memory of 2080	2260	New Order.2087.pdf.exe	35
PID 2260 wrote to memory of 2080	2260	New Order.2087.pdf.exe	35
PID 2260 wrote to memory of 2080	2260	New Order.2087.pdf.exe	35
PID 2260 wrote to memory of 2080	2260	New Order.2087.pdf.exe	35
PID 2260 wrote to memory of 2980	2260	New Order.2087.pdf.exe	37
PID 2260 wrote to memory of 2980	2260	New Order.2087.pdf.exe	37
PID 2260 wrote to memory of 2980	2260	New Order.2087.pdf.exe	37
PID 2260 wrote to memory of 2980	2260	New Order.2087.pdf.exe	37
PID 2260 wrote to memory of 2992	2260	New Order.2087.pdf.exe	36
PID 2260 wrote to memory of 2992	2260	New Order.2087.pdf.exe	36
PID 2260 wrote to memory of 2992	2260	New Order.2087.pdf.exe	36
PID 2260 wrote to memory of 2992	2260	New Order.2087.pdf.exe	36

C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mLgmrVaZaprP.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mLgmrVaZaprP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92A0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
  2⤵
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
  2⤵
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.2087.pdf.exe"
  2⤵
  PID:2980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp92A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp92A0.tmp
Size 1KB
SHA256 9faae8d9b4ab890e69ea29cd5f67981606e5dc5c959888fc26e2e7e6c948bc60
MD5 0979e1f273dcced057132ae056891fae
SHA1 e45bfc595fce4ca1be462a11bfa9dc8af5953558
SHA512 f4781f1b7947f4ab9a7cf218421c8c75b4c21af517fff87ea318e4fd1e1caa4fb580ed12edca23d3c4eb914c2898e8366ca78e7e7e42b4bb7600e9a15ebd3e80
MD5 SHA1 SHA512

Submit Download

memory/2260-54-0x00000000003F0000-0x0000000000482000-memory.dmp

Download

memory/2260-55-0x0000000004190000-0x00000000041D0000-memory.dmp

Download

memory/2260-56-0x00000000006C0000-0x00000000006CC000-memory.dmp

Download

memory/2260-57-0x0000000004190000-0x00000000041D0000-memory.dmp

Download

memory/2260-58-0x00000000006D0000-0x00000000006DA000-memory.dmp

Download

memory/2260-59-0x0000000005590000-0x00000000055FA000-memory.dmp

Download

memory/2972-67-0x00000000026C0000-0x0000000002700000-memory.dmp

Download

memory/2972-68-0x00000000026C0000-0x0000000002700000-memory.dmp

Download