e4dd8be1ee9015d4b3097904e7173a5e8201d81e0253120e09618d3407477e75

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vessel's details_pdf.scr
Size

664KB
MD5

d959324b388c0102201beabacaaee229
SHA1

910484fa63f93c0e524ca951d2ac3ae7c9910f2a
SHA256

fac10c25eb41bbb2169988b5140a6600cf910b80483b2d32020d23a702605de0
SHA512

29230d304711cc68d5065e7aece00aa163478d0f965891b424667258ab13a655917cd0a12947afd7782e4d587ecf19749c895a79abcfa66bd59e4a51a708f67f
SSDEEP

12288:ySIReQpHHFWQvgIwHCQNi5vNF34yecktJ7q9s/oMQWGbY2CuYBKYvI8t:ySgeQpHHUQvgIwm5vbkbq13TCuYO

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe
2560	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vessel's details_pdf.scr

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2236	Vessel's details_pdf.scr
2796	powershell.exe
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	Vessel's details_pdf.scr
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2796	2236	Vessel's details_pdf.scr	30
PID 2236 wrote to memory of 2796	2236	Vessel's details_pdf.scr	30
PID 2236 wrote to memory of 2796	2236	Vessel's details_pdf.scr	30
PID 2236 wrote to memory of 2796	2236	Vessel's details_pdf.scr	30
PID 2236 wrote to memory of 2560	2236	Vessel's details_pdf.scr	32
PID 2236 wrote to memory of 2560	2236	Vessel's details_pdf.scr	32
PID 2236 wrote to memory of 2560	2236	Vessel's details_pdf.scr	32
PID 2236 wrote to memory of 2560	2236	Vessel's details_pdf.scr	32
PID 2236 wrote to memory of 2552	2236	Vessel's details_pdf.scr	33
PID 2236 wrote to memory of 2552	2236	Vessel's details_pdf.scr	33
PID 2236 wrote to memory of 2552	2236	Vessel's details_pdf.scr	33
PID 2236 wrote to memory of 2552	2236	Vessel's details_pdf.scr	33
PID 2236 wrote to memory of 2324	2236	Vessel's details_pdf.scr	36
PID 2236 wrote to memory of 2324	2236	Vessel's details_pdf.scr	36
PID 2236 wrote to memory of 2324	2236	Vessel's details_pdf.scr	36
PID 2236 wrote to memory of 2324	2236	Vessel's details_pdf.scr	36
PID 2236 wrote to memory of 2956	2236	Vessel's details_pdf.scr	37
PID 2236 wrote to memory of 2956	2236	Vessel's details_pdf.scr	37
PID 2236 wrote to memory of 2956	2236	Vessel's details_pdf.scr	37
PID 2236 wrote to memory of 2956	2236	Vessel's details_pdf.scr	37
PID 2236 wrote to memory of 1428	2236	Vessel's details_pdf.scr	38
PID 2236 wrote to memory of 1428	2236	Vessel's details_pdf.scr	38
PID 2236 wrote to memory of 1428	2236	Vessel's details_pdf.scr	38
PID 2236 wrote to memory of 1428	2236	Vessel's details_pdf.scr	38
PID 2236 wrote to memory of 304	2236	Vessel's details_pdf.scr	39
PID 2236 wrote to memory of 304	2236	Vessel's details_pdf.scr	39
PID 2236 wrote to memory of 304	2236	Vessel's details_pdf.scr	39
PID 2236 wrote to memory of 304	2236	Vessel's details_pdf.scr	39
PID 2236 wrote to memory of 264	2236	Vessel's details_pdf.scr	40
PID 2236 wrote to memory of 264	2236	Vessel's details_pdf.scr	40
PID 2236 wrote to memory of 264	2236	Vessel's details_pdf.scr	40
PID 2236 wrote to memory of 264	2236	Vessel's details_pdf.scr	40

C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
"C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eBPZTjiUzE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eBPZTjiUzE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D4B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
  "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
  "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
  "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  PID:1428
- C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
  "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  PID:304
- C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr
  "C:\Users\Admin\AppData\Local\Temp\Vessel's details_pdf.scr"
  2⤵
  PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7D4B.tmp

Filesize
1KB

MD5
67a9422309a6ef9447f0faa655cb793d

SHA1
06b570b9e32480de14036198d7063e9aceeb5ead

SHA256
9f8fec9560397975ce71661f563794acb53d4ecaadda0b8af52a4601596689d8

SHA512
20f4cfd10fc50110137b1ecbef29b77d7a0cf075faf1511eeb4a8db3685828044e415502fb5324675db4a9fa95c996fe18942c780c5478a7587394eece4b5692

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
aff4852aa739c61381747abfe646c7b4

SHA1
25fbbba767e305e29ee867d6670496902dd68a49

SHA256
189ba60e9720cd66ff9cec2dad8559c1e39d3129480a21543e10e319e95e05aa

SHA512
66924cd175cf099352610e5a4eba35ede0fda4eaed2c488c564816f921dc959deae61daf1a3ebf13b1a389c9d314783be82f4e4de19a6356520696249cc7c8e3

Download Submit
memory/2236-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000390000-0x000000000043A000-memory.dmp

Filesize
680KB

Download
memory/2236-2-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2236-3-0x0000000001EA0000-0x0000000001EB8000-memory.dmp

Filesize
96KB

Download
memory/2236-4-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2236-5-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2236-6-0x0000000005A10000-0x0000000005A92000-memory.dmp

Filesize
520KB

Download
memory/2236-19-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download