Analysis

  • max time kernel
    94s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 08:38

General

  • Target

    pko_trans_details_20240710_105339·pdf.exe

  • Size

    477KB

  • MD5

    c601d5e720a191b1e304c8bcbf63b675

  • SHA1

    80133fe77b17d44886e6201d7723be90489a55d2

  • SHA256

    d7325eb4553b2c58a8580cb84af63cfe5cdf4ff23a3d4e09a963c656d5717d8c

  • SHA512

    2a78f640f01f365d23bb45bfc96e6900eb1814804bbf905876ac9d6e9353fd3e648efc08858b9e29e41eb6c2262e528d34b00d847524aeeabf41eb319792566f

  • SSDEEP

    6144:39X0GFlllllllqllllllllllllhllllYllltlld0wz/ypzAJP8xvP2nWaLcAqRFk:R0Nwzy4EP2nWaPqzJgBKjYl92gCU3Bbl

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pko_trans_details_20240710_105339·pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\pko_trans_details_20240710_105339·pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Forhrt=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Helicopter.San';$Forset=$Forhrt.SubString(45874,3);.$Forset($Forhrt)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4848
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 2644
        3⤵
        • Program crash
        PID:4988
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4848 -ip 4848
    1⤵
      PID:4424

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ngteszyj.lto.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\nsfAD48.tmp\BgImage.dll

      Filesize

      7KB

      MD5

      521df745a41f0b8164ffd01717cacbba

      SHA1

      dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74

      SHA256

      dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b

      SHA512

      c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe

    • C:\Users\Admin\AppData\Local\Temp\nsfAD48.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      acbda33dd5700c122e2fe48e3d4351fd

      SHA1

      2c154baf7c64052ee712b7cdf9c36b7697dd3fc8

      SHA256

      943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0

      SHA512

      d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd

    • C:\Users\Admin\AppData\Local\Temp\nsfAD48.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      1c8b2b40c642e8b5a5b3ff102796fb37

      SHA1

      3245f55afac50f775eb53fd6d14abb7fe523393d

      SHA256

      8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

      SHA512

      4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

    • C:\Users\Admin\AppData\Local\kilns\Unobtainably\Helicopter.San

      Filesize

      67KB

      MD5

      bf1ebfd1285dd7ef43a587e9f51a8e33

      SHA1

      1dede4026611e9f40c91d9bbe406a06b2fd8bfa4

      SHA256

      de1db1c0a065f580b4fe878c5b363933e45ec7f0c06118d29b6d167af24189ff

      SHA512

      3b7b11a8989a0b46e4091c8e4c81e71a2454fc9fba77618d844653d548ecd59a2c8b8fce3338fa499ca84da8664f7e34f355ab8b18e3507598f5f63dd3a80389

    • memory/4848-30-0x00000000059E0000-0x0000000005A46000-memory.dmp

      Filesize

      408KB

    • memory/4848-43-0x0000000006110000-0x000000000615C000-memory.dmp

      Filesize

      304KB

    • memory/4848-28-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4848-29-0x0000000005110000-0x0000000005132000-memory.dmp

      Filesize

      136KB

    • memory/4848-31-0x0000000005A50000-0x0000000005AB6000-memory.dmp

      Filesize

      408KB

    • memory/4848-26-0x00000000053B0000-0x00000000059D8000-memory.dmp

      Filesize

      6.2MB

    • memory/4848-25-0x0000000002AD0000-0x0000000002B06000-memory.dmp

      Filesize

      216KB

    • memory/4848-41-0x0000000005AC0000-0x0000000005E14000-memory.dmp

      Filesize

      3.3MB

    • memory/4848-42-0x00000000060C0000-0x00000000060DE000-memory.dmp

      Filesize

      120KB

    • memory/4848-27-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4848-46-0x0000000006610000-0x0000000006632000-memory.dmp

      Filesize

      136KB

    • memory/4848-45-0x00000000065F0000-0x000000000660A000-memory.dmp

      Filesize

      104KB

    • memory/4848-44-0x00000000072A0000-0x0000000007336000-memory.dmp

      Filesize

      600KB

    • memory/4848-47-0x00000000078F0000-0x0000000007E94000-memory.dmp

      Filesize

      5.6MB

    • memory/4848-24-0x0000000073DFE000-0x0000000073DFF000-memory.dmp

      Filesize

      4KB

    • memory/4848-49-0x0000000008520000-0x0000000008B9A000-memory.dmp

      Filesize

      6.5MB

    • memory/4848-51-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB