f3a22e965f778a9b4072a659166407e283688a20492feff37818f61b969efa96

General

Target

detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
Size

583KB
MD5

b8a89704d7c7ca02539576bdfc10ca7a
SHA1

f23f9988f2db7cbab1401d5d90a00a9101c6c188
SHA256

f3a22e965f778a9b4072a659166407e283688a20492feff37818f61b969efa96
SHA512

b1d1f2df73472daba9097801501ac5bd2add87f3598235965c662eaa04ecb7730bbdf454a18ccd8c87e2be7c848195de8a383feac900b252b7819f337f4a1ed4
SSDEEP

12288:1oGrk4f6kRkGDzfQ/kBvjzowwc/Lds0lE5SaR9K/vxtUf7:1oGI4ykRkGDOSrzowje0lE9cvxu

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\playgoers.sep	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File created	C:\Windows\SysWOW64\bores.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\SysWOW64\bores.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File created	C:\Windows\SysWOW64\Pentose.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\SysWOW64\Pentose.lnk	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Pygopagus172\matthfus.ala	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\lnstigningsmnstre\Ccny.sta	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\Vaginismus.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Program Files (x86)\Common Files\nvningedomstol\arbejdskommando.sto	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\yer.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\truthlessly\Stablish.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\resources\0409\ejerlst.uns	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
File opened for modification	C:\Windows\resources\fysiurg\Cheesecutter.ini	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1900	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1900	4372	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	91
PID 4372 wrote to memory of 1900	4372	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	91
PID 4372 wrote to memory of 1900	4372	detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe	91
PID 1900 wrote to memory of 4848	1900	powershell.exe	94
PID 1900 wrote to memory of 4848	1900	powershell.exe	94
PID 1900 wrote to memory of 4848	1900	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_2024-06-17T205732.008 0200_1765330002017577_PDF.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Autovivisection248=Get-Content 'C:\Users\Admin\AppData\Local\Temp\fingerstningerne\flagellulae\Undervisningsforloebet\Stilleren.Arr34';$Costlinesses=$Autovivisection248.SubString(53405,3);.$Costlinesses($Autovivisection248)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 2712
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1900 -ip 1900
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vmxlbsxo.c45.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fingerstningerne\flagellulae\Undervisningsforloebet\Stilleren.Arr34

Filesize
52KB

MD5
ac09839181ff74c2d9c1ad18406a8534

SHA1
caafe7f80ecf76e3ed6c14cc0e97fc614e8ba39e

SHA256
0fe7c99bee156386cd337727c7384e81468a0a2b78fe6ba603d493778baa73fd

SHA512
5d95a3072235f17d84d151ac12886a3ce711445d6a7e0d4a214d1b3e51683a151c62229aeea4c4233a272ae08bb8605e8fd8a2766ce6ecd8b8487b4b24380885

Download Submit
C:\Windows\SysWOW64\bores.lnk

Filesize
1KB

MD5
3cf0dc3f15bb69bac041434af810aa83

SHA1
4fe8b7c9872e85eaee4228f7157751fbeae63d13

SHA256
0150929cbd94f1c91e967a56bd71bf21de4133c9920dcca3dc5a84d4d2f136cd

SHA512
c88a81598d7cc6b1883ecbdcfca7020a10ea493ee88d093f653464f489dea234750e368a784ae44084621f9ca1f6f6521fd0cb5ccc3fa3f4d72c9baa4a884d7b

Download Submit
C:\Windows\yer.ini

Filesize
38B

MD5
e58f8a2dcf15a626bc785906a24d269a

SHA1
451f8692070432dbd0232c61631cb49874323fd7

SHA256
39b313e3f6e503de2657691e96235891834d12dab42957e62aea1c588c35bc83

SHA512
7c33aec2758c72eb727f156ca5946626409a1b2ad22a980801436acacac1bf05eac231a2a0cc2858d369a54cbfa3cafdbd449ce696bf6c8fcecfb53699a75bd3

Download Submit
memory/1900-72-0x00000000738C0000-0x0000000074070000-memory.dmp

Filesize
7.7MB

Download
memory/1900-110-0x0000000006980000-0x00000000069CC000-memory.dmp

Filesize
304KB

Download
memory/1900-75-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/1900-76-0x0000000006200000-0x0000000006266000-memory.dmp

Filesize
408KB

Download
memory/1900-79-0x0000000006270000-0x00000000062D6000-memory.dmp

Filesize
408KB

Download
memory/1900-67-0x00000000059A0000-0x0000000005FC8000-memory.dmp

Filesize
6.2MB

Download
memory/1900-66-0x0000000005330000-0x0000000005366000-memory.dmp

Filesize
216KB

Download
memory/1900-105-0x00000000062E0000-0x0000000006634000-memory.dmp

Filesize
3.3MB

Download
memory/1900-109-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/1900-68-0x00000000738C0000-0x0000000074070000-memory.dmp

Filesize
7.7MB

Download
memory/1900-111-0x0000000006E80000-0x0000000006F16000-memory.dmp

Filesize
600KB

Download
memory/1900-112-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Filesize
104KB

Download
memory/1900-113-0x00000000078E0000-0x0000000007902000-memory.dmp

Filesize
136KB

Download
memory/1900-114-0x0000000007EC0000-0x0000000008464000-memory.dmp

Filesize
5.6MB

Download
memory/1900-65-0x00000000738CE000-0x00000000738CF000-memory.dmp

Filesize
4KB

Download
memory/1900-116-0x0000000008AF0000-0x000000000916A000-memory.dmp

Filesize
6.5MB

Download
memory/1900-117-0x00000000738C0000-0x0000000074070000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing