226c51d48dc1734480b8e37ea9a4fdf57c5a7e6cb316905b38f9650292d980c0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment_Advice.pdf.exe
Size

742KB
MD5

efab7252e79203b247e72fcc30fbe9f2
SHA1

87af83d50fe26dc53b7ffbaf9d8427493b83ea62
SHA256

226c51d48dc1734480b8e37ea9a4fdf57c5a7e6cb316905b38f9650292d980c0
SHA512

8fc8bb1ee597e06d6a037de0e9e10b2474a8c73d6144d543eec7d4e9476d5d396f5424bde85a40cc74af9819359b77d5e2e96be23f34647ca3d3325db968161e
SSDEEP

12288:T4CMwiMp9rYvbZzL9m4tLWc0KY8pcz2S7IWjL9axCEluzAjypQY5t4oi68A:MO9rUzL9NqJ98uqS7Ii9axCAyz4G

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 4528	2856	Payment_Advice.pdf.exe	97
PID 4528 set thread context of 3540	4528	Payment_Advice.pdf.exe	57
PID 4528 set thread context of 4624	4528	Payment_Advice.pdf.exe	107
PID 4624 set thread context of 3540	4624	reg.exe	57

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	reg.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4528	Payment_Advice.pdf.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4528	Payment_Advice.pdf.exe
3540	Explorer.EXE
3540	Explorer.EXE
4624	reg.exe
4624	reg.exe
4624	reg.exe
4624	reg.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3540	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 2856 wrote to memory of 4528	2856	Payment_Advice.pdf.exe	97
PID 3540 wrote to memory of 4624	3540	Explorer.EXE	107
PID 3540 wrote to memory of 4624	3540	Explorer.EXE	107
PID 3540 wrote to memory of 4624	3540	Explorer.EXE	107
PID 4624 wrote to memory of 2764	4624	reg.exe	115
PID 4624 wrote to memory of 2764	4624	reg.exe	115
PID 4624 wrote to memory of 2764	4624	reg.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4528
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\SysWOW64\reg.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-8-0x0000000005540000-0x000000000554C000-memory.dmp

Filesize
48KB

Download
memory/2856-9-0x00000000069A0000-0x0000000006A2A000-memory.dmp

Filesize
552KB

Download
memory/2856-2-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download
memory/2856-3-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/2856-4-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/2856-5-0x0000000005290000-0x000000000529A000-memory.dmp

Filesize
40KB

Download
memory/2856-0-0x0000000000820000-0x00000000008DE000-memory.dmp

Filesize
760KB

Download
memory/2856-6-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/2856-1-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/2856-7-0x0000000005400000-0x0000000005412000-memory.dmp

Filesize
72KB

Download
memory/2856-12-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3540-36-0x0000000007270000-0x0000000007341000-memory.dmp

Filesize
836KB

Download
memory/3540-28-0x0000000007270000-0x0000000007341000-memory.dmp

Filesize
836KB

Download
memory/3540-29-0x0000000007270000-0x0000000007341000-memory.dmp

Filesize
836KB

Download
memory/3540-18-0x000000000D730000-0x000000000E6A0000-memory.dmp

Filesize
15.4MB

Download
memory/3540-26-0x000000000D730000-0x000000000E6A0000-memory.dmp

Filesize
15.4MB

Download
memory/4528-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-17-0x00000000016E0000-0x0000000001704000-memory.dmp

Filesize
144KB

Download
memory/4528-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-13-0x0000000001870000-0x0000000001BBA000-memory.dmp

Filesize
3.3MB

Download
memory/4528-22-0x00000000016E0000-0x0000000001704000-memory.dmp

Filesize
144KB

Download
memory/4528-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4624-24-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download
memory/4624-25-0x00000000018E0000-0x0000000001983000-memory.dmp

Filesize
652KB

Download
memory/4624-27-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download
memory/4624-23-0x0000000001A40000-0x0000000001D8A000-memory.dmp

Filesize
3.3MB

Download
memory/4624-20-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download
memory/4624-19-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download