96ae2cb9018ac1f437f0db47d02f634ec622c2d8af7e2e61debfbcaeb77d4561

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Info.Pdf______________________________________________________________.exe
Size

200KB
MD5

3f7af6433aaeb4f5b2bcda80d2fc562a
SHA1

e57e81f201475dfe366df682a4ffa40a4ff78766
SHA256

b55ceb179a583bdfd46cb684e032a9b431cc8189fb5fba4b93be994583779ef0
SHA512

9e8ff124244439ff027d7bf9929a19abc055a4b8d7dc3e25e9b1617fb2fdbd9161f852b9edd6cb5ec4a8cf45eda87cfc07fee1cf65a92ba3b97ee4a341abe107
SSDEEP

6144:nzWS6rxJdVeCMo0oQkiAlnNBGKU+jyg9mPJVC1pNEdP0PoSS:nzR6lJulo04vz9jfmPLiyPkoSS

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2464	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2384	ifuwk.exe

Loads dropped DLL 2 IoCs

pid	Process
3024	Info.Pdf______________________________________________________________.exe
3024	Info.Pdf______________________________________________________________.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/files/0x00070000000194a4-11.dat	upx
behavioral1/memory/2384-20-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\{2D9C174D-2A57-B133-0130-C29D21796348} = "C:\\Users\\Admin\\AppData\\Roaming\\Apudo\\ifuwk.exe"	ifuwk.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	ifuwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	Info.Pdf______________________________________________________________.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Info.Pdf______________________________________________________________.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ifuwk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 2464	3024	Info.Pdf______________________________________________________________.exe	33

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Privacy	Info.Pdf______________________________________________________________.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	Info.Pdf______________________________________________________________.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\6A441E34-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe
2384	ifuwk.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3024	Info.Pdf______________________________________________________________.exe
Token: SeSecurityPrivilege	3024	Info.Pdf______________________________________________________________.exe
Token: SeSecurityPrivilege	3024	Info.Pdf______________________________________________________________.exe
Token: SeManageVolumePrivilege	2152	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2152	WinMail.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2152	WinMail.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2384	3024	Info.Pdf______________________________________________________________.exe	31
PID 3024 wrote to memory of 2384	3024	Info.Pdf______________________________________________________________.exe	31
PID 3024 wrote to memory of 2384	3024	Info.Pdf______________________________________________________________.exe	31
PID 3024 wrote to memory of 2384	3024	Info.Pdf______________________________________________________________.exe	31
PID 2384 wrote to memory of 1044	2384	ifuwk.exe	17
PID 2384 wrote to memory of 1044	2384	ifuwk.exe	17
PID 2384 wrote to memory of 1044	2384	ifuwk.exe	17
PID 2384 wrote to memory of 1044	2384	ifuwk.exe	17
PID 2384 wrote to memory of 1044	2384	ifuwk.exe	17
PID 2384 wrote to memory of 1104	2384	ifuwk.exe	19
PID 2384 wrote to memory of 1104	2384	ifuwk.exe	19
PID 2384 wrote to memory of 1104	2384	ifuwk.exe	19
PID 2384 wrote to memory of 1104	2384	ifuwk.exe	19
PID 2384 wrote to memory of 1104	2384	ifuwk.exe	19
PID 2384 wrote to memory of 1184	2384	ifuwk.exe	21
PID 2384 wrote to memory of 1184	2384	ifuwk.exe	21
PID 2384 wrote to memory of 1184	2384	ifuwk.exe	21
PID 2384 wrote to memory of 1184	2384	ifuwk.exe	21
PID 2384 wrote to memory of 1184	2384	ifuwk.exe	21
PID 2384 wrote to memory of 1596	2384	ifuwk.exe	25
PID 2384 wrote to memory of 1596	2384	ifuwk.exe	25
PID 2384 wrote to memory of 1596	2384	ifuwk.exe	25
PID 2384 wrote to memory of 1596	2384	ifuwk.exe	25
PID 2384 wrote to memory of 1596	2384	ifuwk.exe	25
PID 2384 wrote to memory of 3024	2384	ifuwk.exe	30
PID 2384 wrote to memory of 3024	2384	ifuwk.exe	30
PID 2384 wrote to memory of 3024	2384	ifuwk.exe	30
PID 2384 wrote to memory of 3024	2384	ifuwk.exe	30
PID 2384 wrote to memory of 3024	2384	ifuwk.exe	30
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 3024 wrote to memory of 2464	3024	Info.Pdf______________________________________________________________.exe	33
PID 2384 wrote to memory of 348	2384	ifuwk.exe	35
PID 2384 wrote to memory of 348	2384	ifuwk.exe	35
PID 2384 wrote to memory of 348	2384	ifuwk.exe	35
PID 2384 wrote to memory of 348	2384	ifuwk.exe	35
PID 2384 wrote to memory of 348	2384	ifuwk.exe	35

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1044

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\Info.Pdf______________________________________________________________.exe
  "C:\Users\Admin\AppData\Local\Temp\Info.Pdf______________________________________________________________.exe"
  2⤵
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Roaming\Apudo\ifuwk.exe
    "C:\Users\Admin\AppData\Roaming\Apudo\ifuwk.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcd7f9611.bat"
    3⤵
    - Deletes itself
    PID:2464

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1596

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
01cc51148afc8a4b679551d1f455e619

SHA1
60167970be7d4e78da9337fd4e13fe3dfe6956b1

SHA256
56e5d5ee6ed1a6e4c90977ba1bf5e2ffe5ec8aad1c848f9e3cc49c8170d3b140

SHA512
b5cd53aac8df509aeac3fb5efe6a6cd4338dde2c795431842d4d4452ccad524c17ac33664a33901a03d9d61efada9837a7fdff5fa114923653d54bf3d77206de

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcd7f9611.bat

Filesize
319B

MD5
872968946bbe7da83ce98f87aef6f4fc

SHA1
610a5081dbb8334dd4019e49764f32be47f4da13

SHA256
99d70e8cdf80f176902853f4e9f42cf6a865ecb930f446236d30ad2b6ad9dabc

SHA512
e834a4a0273b65f63fdf7adf958884f1b689a7dd9f53783166983bf4fc560732ca3bcd1679c3739a7b593eb627afb3af1f0b5bf1466b1e6442899c35cd96efbe

Download Submit
C:\Users\Admin\AppData\Roaming\Uvmy\eflet.yhe

Filesize
437B

MD5
68ff0e326f8013d15137d52b501d10af

SHA1
8cea7dc4592f9a097b375c5b4b9ef230fb396208

SHA256
4fdd4f41622514224cbefbc6d933efbbe329fbc25c65281b719550b17b99c501

SHA512
6e509d6bb6a830dfd5bd1abfcf8c6bae98d76c7d8ea6d9360c6477b466343eb7e5ba38e98ffbe632bce54ec0890306362d1f867c7909d0cda979a509c36db001

Download Submit
\Users\Admin\AppData\Roaming\Apudo\ifuwk.exe

Filesize
200KB

MD5
8159ed1a7ec1393b9cda8cb4fe6c8788

SHA1
f72a58f6eaa13624471619e8af5944cd37097fd4

SHA256
4969c68d684659dedfdfa7a8a7d8194b55a0c9757f3b16335069b74f5dd078a8

SHA512
f123c747289bad24579b40378daf4f047100aa7f7a8ee301194950f1dd2d6004b6ea7ebd5093d059e8e0679f9e671a81b83376725a5d24698540d3cecaacf120

Download Submit
memory/1044-35-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/1044-33-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/1044-31-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/1044-37-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/1044-29-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/1104-44-0x00000000001B0000-0x00000000001E0000-memory.dmp

Filesize
192KB

Download
memory/1104-41-0x00000000001B0000-0x00000000001E0000-memory.dmp

Filesize
192KB

Download
memory/1104-42-0x00000000001B0000-0x00000000001E0000-memory.dmp

Filesize
192KB

Download
memory/1104-43-0x00000000001B0000-0x00000000001E0000-memory.dmp

Filesize
192KB

Download
memory/1184-49-0x0000000002D50000-0x0000000002D80000-memory.dmp

Filesize
192KB

Download
memory/1184-46-0x0000000002D50000-0x0000000002D80000-memory.dmp

Filesize
192KB

Download
memory/1184-47-0x0000000002D50000-0x0000000002D80000-memory.dmp

Filesize
192KB

Download
memory/1184-48-0x0000000002D50000-0x0000000002D80000-memory.dmp

Filesize
192KB

Download
memory/1596-55-0x0000000000320000-0x0000000000350000-memory.dmp

Filesize
192KB

Download
memory/1596-51-0x0000000000320000-0x0000000000350000-memory.dmp

Filesize
192KB

Download
memory/1596-53-0x0000000000320000-0x0000000000350000-memory.dmp

Filesize
192KB

Download
memory/1596-57-0x0000000000320000-0x0000000000350000-memory.dmp

Filesize
192KB

Download
memory/2384-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2384-26-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2384-535-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-4-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-64-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-66-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-1-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download
memory/3024-19-0x0000000001FC0000-0x0000000002029000-memory.dmp

Filesize
420KB

Download
memory/3024-65-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-18-0x0000000001FC0000-0x0000000002029000-memory.dmp

Filesize
420KB

Download
memory/3024-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3024-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3024-61-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-73-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-63-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-75-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-79-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-208-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-207-0x0000000076EE0000-0x0000000076EE1000-memory.dmp

Filesize
4KB

Download
memory/3024-71-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-69-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-294-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-77-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/3024-292-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3024-62-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download