Analysis

  • max time kernel
    606s
  • max time network
    612s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 22:04

General

  • Target

    Tools-Invoice.pdf.exe

  • Size

    272.0MB

  • MD5

    994aae548a9f407ae1784e973ad94693

  • SHA1

    08cb87669814ea1848cef750c75a39cd37cc61bf

  • SHA256

    1afc90c1b93eeb299b87b505112b345a64b07e91b0f1e6306a9c2ece7c7feae3

  • SHA512

    ed7fbe45a6d89883cc733899691c4f621f5980bbd4feabfdf2d06a902c250f1ba4c6293d216ff8f76927f2007ebcddf62456a1ac7bba02591972c980a5b6de88

  • SSDEEP

    49152:Uj+t6IRUEFX1PVv3Gfbs8HuQq1nvHol6Kz3DfjkJ:Uj+tNtV/AAFBH9yzL

Malware Config

Extracted

Family

jupyter

C2

http://146.70.71.174

Signatures

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe
      "C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"
      2⤵
      • Executes dropped EXE
      PID:3976
    • C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe" /s
      2⤵
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Tools-Invoice.pdf.exe.log

    Filesize

    425B

    MD5

    fff5cbccb6b31b40f834b8f4778a779a

    SHA1

    899ed0377e89f1ed434cfeecc5bc0163ebdf0454

    SHA256

    b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

    SHA512

    1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

  • C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe

    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r02ty0lz.rg4.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1044-1-0x00007FFAC6F80000-0x00007FFAC7A41000-memory.dmp

    Filesize

    10.8MB

  • memory/1044-13-0x00007FFAC6F80000-0x00007FFAC7A41000-memory.dmp

    Filesize

    10.8MB

  • memory/1044-0-0x00000000006F0000-0x000000000092E000-memory.dmp

    Filesize

    2.2MB

  • memory/2368-32-0x000000001C270000-0x000000001C292000-memory.dmp

    Filesize

    136KB

  • memory/2368-12-0x00007FFAC6F80000-0x00007FFAC7A41000-memory.dmp

    Filesize

    10.8MB

  • memory/2368-40-0x000000001BD60000-0x000000001BD70000-memory.dmp

    Filesize

    64KB

  • memory/2368-17-0x00007FFAC6F80000-0x00007FFAC7A41000-memory.dmp

    Filesize

    10.8MB

  • memory/2368-35-0x000000001D010000-0x000000001D0C4000-memory.dmp

    Filesize

    720KB

  • memory/2368-31-0x000000001BD60000-0x000000001BD70000-memory.dmp

    Filesize

    64KB

  • memory/3976-14-0x0000000000680000-0x0000000000681000-memory.dmp

    Filesize

    4KB

  • memory/3976-18-0x0000000000680000-0x0000000000681000-memory.dmp

    Filesize

    4KB

  • memory/3976-15-0x0000000000400000-0x0000000000500000-memory.dmp

    Filesize

    1024KB