84deede63e52ad9249ab9907c8adb40cf822c95d2a7057da3efd72784266b797

General

Target

número de pedido 012779-pdf.exe
Size

756KB
MD5

67e15999c73fb5a9119e74db15dcbf0e
SHA1

821f318b7db0812f051323578b3ef1c7c7f5797c
SHA256

84deede63e52ad9249ab9907c8adb40cf822c95d2a7057da3efd72784266b797
SHA512

deffc9ee169602d0dfdcdec8b9a74b7bd2dac285eb26bf1ec145d453443617d0f68c619ff07bc0a473c2bbdac338d12a8ce799b0d85f2b8394622a7ce1afd460
SSDEEP

12288:R+D/Pu1N9o7g5lEPg1uJZbCPJMXj/tHxxuVGBDZsmahI9ZE2Zpxwp+BL:R+jub0S2Pg1wbCP2TVXuGWeE2ZpxU+J

Score

10^/10

evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

número de pedido 012779-pdf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	número de pedido 012779-pdf.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

número de pedido 012779-pdf.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions número de pedido 012779-pdf.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2624 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

número de pedido 012779-pdf.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools número de pedido 012779-pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	número de pedido 012779-pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	número de pedido 012779-pdf.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

número de pedido 012779-pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	número de pedido 012779-pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	número de pedido 012779-pdf.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

número de pedido 012779-pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	número de pedido 012779-pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	número de pedido 012779-pdf.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

número de pedido 012779-pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	número de pedido 012779-pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	número de pedido 012779-pdf.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

número de pedido 012779-pdf.exewab.exemtstocom.exe

description	pid	process	target process
PID 1952 set thread context of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 2464 set thread context of 1952	2464	wab.exe	número de pedido 012779-pdf.exe
PID 2464 set thread context of 1952	2464	wab.exe	número de pedido 012779-pdf.exe
PID 2464 set thread context of 1952	2464	wab.exe	número de pedido 012779-pdf.exe
PID 2464 set thread context of 1216	2464	wab.exe	Explorer.EXE
PID 2464 set thread context of 2224	2464	wab.exe	mtstocom.exe
PID 2224 set thread context of 1952	2224	mtstocom.exe	número de pedido 012779-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exewab.exemtstocom.exe

pid	process
2624	powershell.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
2224	mtstocom.exe
2224	mtstocom.exe
2224	mtstocom.exe
2224	mtstocom.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

wab.exeExplorer.EXEmtstocom.exe

pid process

2464 wab.exe
2464 wab.exe
2464 wab.exe
2464 wab.exe
1216 Explorer.EXE
1216 Explorer.EXE
2224 mtstocom.exe
2224 mtstocom.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

número de pedido 012779-pdf.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1952 número de pedido 012779-pdf.exe
Token: SeDebugPrivilege 2624 powershell.exe

pid	process
2464	wab.exe
2464	wab.exe
2464	wab.exe
2464	wab.exe
1216	Explorer.EXE
1216	Explorer.EXE
2224	mtstocom.exe
2224	mtstocom.exe

description	pid	process
Token: SeDebugPrivilege	1952	número de pedido 012779-pdf.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

número de pedido 012779-pdf.exeExplorer.EXE

description	pid	process	target process
PID 1952 wrote to memory of 2624	1952	número de pedido 012779-pdf.exe	powershell.exe
PID 1952 wrote to memory of 2624	1952	número de pedido 012779-pdf.exe	powershell.exe
PID 1952 wrote to memory of 2624	1952	número de pedido 012779-pdf.exe	powershell.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2464	1952	número de pedido 012779-pdf.exe	wab.exe
PID 1952 wrote to memory of 2676	1952	número de pedido 012779-pdf.exe	WerFault.exe
PID 1952 wrote to memory of 2676	1952	número de pedido 012779-pdf.exe	WerFault.exe
PID 1952 wrote to memory of 2676	1952	número de pedido 012779-pdf.exe	WerFault.exe
PID 1216 wrote to memory of 2224	1216	Explorer.EXE	mtstocom.exe
PID 1216 wrote to memory of 2224	1216	Explorer.EXE	mtstocom.exe
PID 1216 wrote to memory of 2224	1216	Explorer.EXE	mtstocom.exe
PID 1216 wrote to memory of 2224	1216	Explorer.EXE	mtstocom.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

número de pedido 012779-pdf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	número de pedido 012779-pdf.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\número de pedido 012779-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\número de pedido 012779-pdf.exe"
2⤵
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\número de pedido 012779-pdf.exe" -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2464

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1952 -s 548
3⤵
PID:2676

C:\Windows\SysWOW64\mtstocom.exe
"C:\Windows\SysWOW64\mtstocom.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2224

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-18-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/1952-1-0x0000000000C90000-0x0000000000CBA000-memory.dmp

Filesize
168KB

Download
memory/1952-2-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/1952-3-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1952-4-0x0000000000B10000-0x0000000000BAA000-memory.dmp

Filesize
616KB

Download
memory/1952-0-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/1952-19-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-28-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2224-26-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2464-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2464-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-15-0x0000000002650000-0x0000000002658000-memory.dmp

Filesize
32KB

Download
memory/2624-14-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads