Overview
overview
10Static
static
3Pepsico Co...le.exe
windows7-x64
7Pepsico Co...le.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3RFQ Data S...FD.xls
windows7-x64
8RFQ Data S...FD.xls
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
Pepsico Company Profile.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
Pepsico Company Profile.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
RFQ Data Sheet Technical Specifications Conditioning System Package_PFD.xls
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
RFQ Data Sheet Technical Specifications Conditioning System Package_PFD.xls
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Pepsico Company Profile.exe
-
Size
649KB
-
MD5
6fe36f5cd0c522ca1241658ec2553db3
-
SHA1
f197615adff4daace92fd2f0c4f266a6170aa464
-
SHA256
e7e5fbeb7606fdcdb246a9df4efaf2896a82cd335babded9231dd990a110628f
-
SHA512
2b288eab811c12a818d089d419b8e51ee0b3692274010303f968fae82dde99a82c8601621860222c3b365f64fcc6508310e51cf3a954414054822d293d39196b
-
SSDEEP
12288:BY0bffsWYCGpoTt4wT3eFjtyiyCgchaxpvQfSgYE:BY0zjqgt/T38jty8hs4fPYE
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
Pepsico Company Profile.exepid Process 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe 1660 Pepsico Company Profile.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2828 1660 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Pepsico Company Profile.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pepsico Company Profile.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
taskmgr.exepid Process 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2860 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 2860 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
taskmgr.exepid Process 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
taskmgr.exepid Process 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe 2860 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Pepsico Company Profile.exedescription pid Process procid_target PID 1660 wrote to memory of 2828 1660 Pepsico Company Profile.exe 31 PID 1660 wrote to memory of 2828 1660 Pepsico Company Profile.exe 31 PID 1660 wrote to memory of 2828 1660 Pepsico Company Profile.exe 31 PID 1660 wrote to memory of 2828 1660 Pepsico Company Profile.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pepsico Company Profile.exe"C:\Users\Admin\AppData\Local\Temp\Pepsico Company Profile.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 5322⤵
- Program crash
PID:2828
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD568b287f4067ba013e34a1339afdb1ea8
SHA145ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA25618e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA51206c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88