5a8549b261a8e1536ad5be7a4f5bf0f7b6615542883034800088a3d2b2927265

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

specification for paraffin wax_pdf.exe
Size

1.2MB
MD5

9e0e33ffd1b85cec00f8345390996cb2
SHA1

7e1c3308ae01ed085784fb5b435d6e28c9e5677b
SHA256

0f2a8d209f2a7c873e7674e213556e75107a67a5554f059ee8eca822b52d5413
SHA512

e178fb04015a35fdcee02d3db1c8f1972665244c788be82ba333e4b26101da281ecce3e55f1737858bfe67871cc87fc90cfb45553663f9c9d56d8feec0b9fbc3
SSDEEP

24576:h4lavt0LkLL9IMixoEgea/E32pNyA9rTGFI7Sq9MmCS:wkwkn9IMHea/LKI2aPCS

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2380	2972	specification for paraffin wax_pdf.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	specification for paraffin wax_pdf.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2972	specification for paraffin wax_pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2972	specification for paraffin wax_pdf.exe
2972	specification for paraffin wax_pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2972	specification for paraffin wax_pdf.exe
2972	specification for paraffin wax_pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2380	2972	specification for paraffin wax_pdf.exe	30
PID 2972 wrote to memory of 2380	2972	specification for paraffin wax_pdf.exe	30
PID 2972 wrote to memory of 2380	2972	specification for paraffin wax_pdf.exe	30
PID 2972 wrote to memory of 2380	2972	specification for paraffin wax_pdf.exe	30
PID 2972 wrote to memory of 2380	2972	specification for paraffin wax_pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\specification for paraffin wax_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\specification for paraffin wax_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\specification for paraffin wax_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bezzo

Filesize
280KB

MD5
8674e529b7dee62ad5481a25131c676b

SHA1
b6fa984257e2980f0ce27ee6f6b9a10a2396ba63

SHA256
04a339f9a6c5d1d307fc85ff933e33b90a254715f39ce2b6252e883efd8907b5

SHA512
4baf971654000c7d1560b5c3fcc1c2ec66ee8ac35ff3bb181a2a3152e4c0ab962b5e3fd3df594508accd55fdb09c8a823e955d2c853c0f1fefa14b18a5790ef7

Download Submit
memory/2380-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2380-8-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2380-9-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/2380-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2972-6-0x0000000000200000-0x0000000000204000-memory.dmp

Filesize
16KB

Download