Analysis
-
max time kernel
69s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 11:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
invoice_2318362983713_823931342io.pdf.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
invoice_2318362983713_823931342io.pdf.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
invoice_2318362983713_823931342io.pdf.exe
-
Size
247KB
-
MD5
ea039a854d20d7734c5add48f1a51c34
-
SHA1
9615dca4c0e46b8a39de5428af7db060399230b2
-
SHA256
69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169
-
SHA512
6718e54a59b91537c41ac913f9d8d6ad97b08cf6a61a4d174458738579a33471ef357173fd9eb4d4c9652ed2bf86c41f6da3cdd20fd7af643cd9f5ee6c9e30d5
-
SSDEEP
6144:Tz/LBBTHT+7oEf2ZstxQMSGToLoOhD2saLsW8fsmFBkObjD:PLBdy7FpQMlToThD+sW8fsmP7bj
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts Process not Found -
Modifies security service 2 TTPs 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security invoice_2318362983713_823931342io.pdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 invoice_2318362983713_823931342io.pdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo invoice_2318362983713_823931342io.pdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters invoice_2318362983713_823931342io.pdf.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\etadpug\ImagePath = "\"C:\\Program Files (x86)\\Google\\Desktop\\Install\\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\\ \\...\\\u202eﯹ๛\\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\\GoogleUpdate.exe\" <" invoice_2318362983713_823931342io.pdf.exe -
Deletes itself 1 IoCs
pid Process 2828 cmd.exe -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\\GoogleUpdate.exe\" >" invoice_2318362983713_823931342io.pdf.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini Process not Found File created \systemroot\assembly\GAC_32\Desktop.ini Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2520 set thread context of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31 -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\en-US:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\@ Process not Found File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\es-ES:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! invoice_2318362983713_823931342io.pdf.exe File created C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\GoogleUpdate.exe invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\de-DE:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! invoice_2318362983713_823931342io.pdf.exe File created C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\@ invoice_2318362983713_823931342io.pdf.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invoice_2318362983713_823931342io.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
NTFS ADS 19 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\en-US:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\de-DE:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! invoice_2318362983713_823931342io.pdf.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\@\:@ Process not Found -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2520 invoice_2318362983713_823931342io.pdf.exe 2520 invoice_2318362983713_823931342io.pdf.exe 2520 invoice_2318362983713_823931342io.pdf.exe 2520 invoice_2318362983713_823931342io.pdf.exe 476 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2520 invoice_2318362983713_823931342io.pdf.exe 2520 invoice_2318362983713_823931342io.pdf.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeRestorePrivilege 2520 invoice_2318362983713_823931342io.pdf.exe Token: SeDebugPrivilege 2520 invoice_2318362983713_823931342io.pdf.exe Token: SeDebugPrivilege 2520 invoice_2318362983713_823931342io.pdf.exe Token: SeRestorePrivilege 2520 invoice_2318362983713_823931342io.pdf.exe Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeBackupPrivilege 476 Process not Found Token: SeRestorePrivilege 476 Process not Found Token: SeSecurityPrivilege 476 Process not Found Token: SeTakeOwnershipPrivilege 476 Process not Found Token: SeDebugPrivilege 476 Process not Found -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31 PID 2520 wrote to memory of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31 PID 2520 wrote to memory of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31 PID 2520 wrote to memory of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31 PID 2520 wrote to memory of 2828 2520 invoice_2318362983713_823931342io.pdf.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice_2318362983713_823931342io.pdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice_2318362983713_823931342io.pdf.exe"1⤵
- Modifies security service
- Sets service image path in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Desktop\Install\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\ \...\ﯹ๛\{c5b0555c-f9e5-c299-24bf-1a4ff565c69a}\@
Filesize2KB
MD5433fb082658ca4b84cd103a478304876
SHA169192923c2ea88a03bc5e65d34360f3056bdad51
SHA256cf57835756eab67f05c9fc844f838d7a533d2259b7cd66cea9ed83b4ace941a9
SHA5127e48e09f81a3443bb0d16980cdb411be2a5972b76a8bab7c29f0c592162d867622c2f01cbe85a5a9632448072b2ed42a82e8c3fb039e5291935209628c65b657