f3a22e965f778a9b4072a659166407e283688a20492feff37818f61b969efa96

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
Size

583KB
MD5

b8a89704d7c7ca02539576bdfc10ca7a
SHA1

f23f9988f2db7cbab1401d5d90a00a9101c6c188
SHA256

f3a22e965f778a9b4072a659166407e283688a20492feff37818f61b969efa96
SHA512

b1d1f2df73472daba9097801501ac5bd2add87f3598235965c662eaa04ecb7730bbdf454a18ccd8c87e2be7c848195de8a383feac900b252b7819f337f4a1ed4
SSDEEP

12288:1oGrk4f6kRkGDzfQ/kBvjzowwc/Lds0lE5SaR9K/vxtUf7:1oGI4ykRkGDOSrzowje0lE9cvxu

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2716	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
10	drive.google.com
11	drive.google.com
13	drive.google.com
3	drive.google.com
6	drive.google.com
7	drive.google.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pentose.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\SysWOW64\Pentose.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\SysWOW64\playgoers.sep	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File created	C:\Windows\SysWOW64\bores.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\SysWOW64\bores.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2716	powershell.exe
1696	ImagingDevices.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 1696	2716	powershell.exe	37

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\lnstigningsmnstre\Ccny.sta	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\Vaginismus.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\nvningedomstol\arbejdskommando.sto	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\Pygopagus172\matthfus.ala	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\fysiurg\Cheesecutter.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\yer.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\truthlessly\Stablish.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\resources\0409\ejerlst.uns	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2716	1964	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	28
PID 1964 wrote to memory of 2716	1964	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	28
PID 1964 wrote to memory of 2716	1964	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	28
PID 1964 wrote to memory of 2716	1964	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	28
PID 2716 wrote to memory of 2652	2716	powershell.exe	30
PID 2716 wrote to memory of 2652	2716	powershell.exe	30
PID 2716 wrote to memory of 2652	2716	powershell.exe	30
PID 2716 wrote to memory of 2652	2716	powershell.exe	30
PID 2716 wrote to memory of 112	2716	powershell.exe	32
PID 2716 wrote to memory of 112	2716	powershell.exe	32
PID 2716 wrote to memory of 112	2716	powershell.exe	32
PID 2716 wrote to memory of 112	2716	powershell.exe	32
PID 2716 wrote to memory of 372	2716	powershell.exe	33
PID 2716 wrote to memory of 372	2716	powershell.exe	33
PID 2716 wrote to memory of 372	2716	powershell.exe	33
PID 2716 wrote to memory of 372	2716	powershell.exe	33
PID 2716 wrote to memory of 1568	2716	powershell.exe	34
PID 2716 wrote to memory of 1568	2716	powershell.exe	34
PID 2716 wrote to memory of 1568	2716	powershell.exe	34
PID 2716 wrote to memory of 1568	2716	powershell.exe	34
PID 2716 wrote to memory of 1532	2716	powershell.exe	35
PID 2716 wrote to memory of 1532	2716	powershell.exe	35
PID 2716 wrote to memory of 1532	2716	powershell.exe	35
PID 2716 wrote to memory of 1532	2716	powershell.exe	35
PID 2716 wrote to memory of 336	2716	powershell.exe	36
PID 2716 wrote to memory of 336	2716	powershell.exe	36
PID 2716 wrote to memory of 336	2716	powershell.exe	36
PID 2716 wrote to memory of 336	2716	powershell.exe	36
PID 2716 wrote to memory of 1696	2716	powershell.exe	37
PID 2716 wrote to memory of 1696	2716	powershell.exe	37
PID 2716 wrote to memory of 1696	2716	powershell.exe	37
PID 2716 wrote to memory of 1696	2716	powershell.exe	37
PID 2716 wrote to memory of 1696	2716	powershell.exe	37
PID 2716 wrote to memory of 1696	2716	powershell.exe	37

C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Autovivisection248=Get-Content 'C:\Users\Admin\AppData\Local\Temp\fingerstningerne\flagellulae\Undervisningsforloebet\Stilleren.Arr34';$Costlinesses=$Autovivisection248.SubString(53405,3);.$Costlinesses($Autovivisection248)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:2652
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:112
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:372
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1568
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1532
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:336
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fingerstningerne\flagellulae\Undervisningsforloebet\Inamovability.Sig

Filesize
293KB

MD5
f056ae67a744f42a231cefb837e97f58

SHA1
18f03591665a3cd1db6fd055075e6882baff734d

SHA256
c01d2a3a74674dea8a47678f6ddd22370085123df03869e6d042b1089927fae9

SHA512
382f7ab1a643e9bbba2a7d1cb0b85509e773aa156a889ac0342ec07d02665f7ae7b5b619014966ad762938e62e3edf7fe6cbebb149119301e7465e40ef2ac34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fingerstningerne\flagellulae\Undervisningsforloebet\Stilleren.Arr34

Filesize
52KB

MD5
ac09839181ff74c2d9c1ad18406a8534

SHA1
caafe7f80ecf76e3ed6c14cc0e97fc614e8ba39e

SHA256
0fe7c99bee156386cd337727c7384e81468a0a2b78fe6ba603d493778baa73fd

SHA512
5d95a3072235f17d84d151ac12886a3ce711445d6a7e0d4a214d1b3e51683a151c62229aeea4c4233a272ae08bb8605e8fd8a2766ce6ecd8b8487b4b24380885

Download Submit
C:\Windows\SysWOW64\bores.lnk

Filesize
1KB

MD5
3a824a10d6cc6ebfc703acf683ff6a34

SHA1
38d36dc4a36eaa27fdfc12c904c0fc670a659bfd

SHA256
b5ff54cc49d6b7a1cd97cdee0649b4107ebbacaf91584d5305a808147ceb81a1

SHA512
8bd8dc9f729566476093e445df3727c0762531eb3345254f19705f54417e23a0c3554af3aa28fcfbe19a46113e3bf2a578f89f74db96a306ca8f6c19fb985c99

Download Submit
C:\Windows\yer.ini

Filesize
38B

MD5
e58f8a2dcf15a626bc785906a24d269a

SHA1
451f8692070432dbd0232c61631cb49874323fd7

SHA256
39b313e3f6e503de2657691e96235891834d12dab42957e62aea1c588c35bc83

SHA512
7c33aec2758c72eb727f156ca5946626409a1b2ad22a980801436acacac1bf05eac231a2a0cc2858d369a54cbfa3cafdbd449ce696bf6c8fcecfb53699a75bd3

Download Submit
memory/1696-102-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2716-93-0x0000000074841000-0x0000000074842000-memory.dmp

Filesize
4KB

Download
memory/2716-95-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-94-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-96-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-97-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-100-0x0000000006840000-0x000000000A361000-memory.dmp

Filesize
59.1MB

Download
memory/2716-101-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download