b100643f39c3bf67b08192f2e8004c01002b8a7710c26147e9403d23face91c7

General

Target

Factuur4388.PDF.exe
Size

772KB
MD5

95f60b5b36d63307d83e3f3de9675a1d
SHA1

da733991d9618b3a3bb5cc503ba0e860f1e8ea29
SHA256

f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674
SHA512

de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff
SSDEEP

12288:6sFxcCZxPEWJNy93q0DWm9+X6MSUJKzR9wz2U7qdyys2he3gxNMlKglt8RsrtUvy:bHP7gqXpKGNehe3x3r8CU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4452	kymhetc.exe
4564	kymhetc.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\x\system.pif	kymhetc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 764 set thread context of 2360	764	Factuur4388.PDF.exe	81
PID 4452 set thread context of 4564	4452	kymhetc.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4080	4564	WerFault.exe	83
4516	4564	WerFault.exe	83

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-d01200000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00380061003200610037003100630039002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00380061003200610037003100630039002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
764	Factuur4388.PDF.exe
764	Factuur4388.PDF.exe
2360	Factuur4388.PDF.exe
2360	Factuur4388.PDF.exe
4452	kymhetc.exe
4452	kymhetc.exe
4564	kymhetc.exe
4564	kymhetc.exe
4564	kymhetc.exe
4564	kymhetc.exe
4564	kymhetc.exe
4564	kymhetc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	kymhetc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
764	Factuur4388.PDF.exe
4452	kymhetc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 764 wrote to memory of 2360	764	Factuur4388.PDF.exe	81
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4452 wrote to memory of 4564	4452	kymhetc.exe	83
PID 4564 wrote to memory of 804	4564	kymhetc.exe	10
PID 804 wrote to memory of 3240	804	svchost.exe	98
PID 804 wrote to memory of 3240	804	svchost.exe	98
PID 804 wrote to memory of 764	804	svchost.exe	99
PID 804 wrote to memory of 764	804	svchost.exe	99
PID 804 wrote to memory of 4864	804	svchost.exe	101
PID 804 wrote to memory of 4864	804	svchost.exe	101

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:3240
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:764
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:4864

C:\Users\Admin\AppData\Local\Temp\Factuur4388.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Factuur4388.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\Factuur4388.PDF.exe
  C:\Users\Admin\AppData\Local\Temp\Factuur4388.PDF.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

C:\Users\Admin\AppData\Local\Temp\kymhetc.exe
C:\Users\Admin\AppData\Local\Temp\kymhetc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\kymhetc.exe
  C:\Users\Admin\AppData\Local\Temp\kymhetc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 656
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 696
    3⤵
    - Program crash
    PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4564 -ip 4564
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4564 -ip 4564
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\vxgchcd

Filesize
654B

MD5
d9b14ce171d406884d4a6e4a6d39c253

SHA1
e670644266db10290db42abec65d0ca868e004fb

SHA256
b04127fb200430577309246da30f43e426a07f485e6effaf91b029049e03993b

SHA512
02fe466572c238183c07c70c1d2011609752e90e53e559a70f237bff3502e75f6ab9654b86be681dc572160dbc5b58ff9539c0b54d3cd0f60ce2afbcef52bb7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kymhetc.exe

Filesize
772KB

MD5
95f60b5b36d63307d83e3f3de9675a1d

SHA1
da733991d9618b3a3bb5cc503ba0e860f1e8ea29

SHA256
f9ae18f90c502fc22c826eb8322a907fa6ddd2b38fdc1b10353d123b8910e674

SHA512
de63bb1117043ee0a7fb478c4a2ba3d283d7f3d71f39fdbe357d2aa403f8f4a4e7eafe53595794ef99c35156aedd3854ba2e015b259af573492e90c96e3f34ff

Download Submit
memory/764-0-0x0000000000B20000-0x0000000000B24000-memory.dmp

Filesize
16KB

Download
memory/804-22-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-3394-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-231-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-67-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-25-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-27-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-21-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/804-19-0x0000000020AF0000-0x0000000020B67000-memory.dmp

Filesize
476KB

Download
memory/2360-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2360-4-0x0000000028960000-0x0000000028B7A000-memory.dmp

Filesize
2.1MB

Download
memory/2360-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2360-5-0x0000000028B80000-0x0000000028DCB000-memory.dmp

Filesize
2.3MB

Download
memory/2360-6-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4452-11-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/4564-16-0x0000000028D90000-0x0000000028FDB000-memory.dmp

Filesize
2.3MB

Download
memory/4564-15-0x0000000000400000-0x00000000004A4600-memory.dmp

Filesize
657KB

Download

Analysis

Sharing