Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
MV TBN CALL PORT FOR LOADING COAL_pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MV TBN CALL PORT FOR LOADING COAL_pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
MV TBN CALL PORT FOR LOADING COAL_pdf.exe
-
Size
641KB
-
MD5
2546f92a54b6f32407cb0d86c91b330c
-
SHA1
3b2eeddcae26a3efbb431fc4863e4765ff556392
-
SHA256
c4152d490edfcc1620c4579bc9e9455b8cb71cb9efecb38140a22385ea95a9ce
-
SHA512
df3cdd886e0ac5c315e47b352030313d189d51d4d959977421e443cf6fffd02df108319b5b277c202567caa86327803e1aaf9830d89c3bbc8ee7015703f28ea4
-
SSDEEP
12288:Tbx119VXiwDIgVFyDu7iKXy2pGL3v5GzD1uIOUgQX14JE9xje50VwXH:BD95lGb5GzDL1pg06
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3032 powershell.exe 1516 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MV TBN CALL PORT FOR LOADING COAL_pdf.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2264 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 3032 powershell.exe 1516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2112 wrote to memory of 3032 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 31 PID 2112 wrote to memory of 3032 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 31 PID 2112 wrote to memory of 3032 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 31 PID 2112 wrote to memory of 3032 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 31 PID 2112 wrote to memory of 1516 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 33 PID 2112 wrote to memory of 1516 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 33 PID 2112 wrote to memory of 1516 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 33 PID 2112 wrote to memory of 1516 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 33 PID 2112 wrote to memory of 2264 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 35 PID 2112 wrote to memory of 2264 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 35 PID 2112 wrote to memory of 2264 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 35 PID 2112 wrote to memory of 2264 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 35 PID 2112 wrote to memory of 2868 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 37 PID 2112 wrote to memory of 2868 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 37 PID 2112 wrote to memory of 2868 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 37 PID 2112 wrote to memory of 2868 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 37 PID 2112 wrote to memory of 2856 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 38 PID 2112 wrote to memory of 2856 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 38 PID 2112 wrote to memory of 2856 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 38 PID 2112 wrote to memory of 2856 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 38 PID 2112 wrote to memory of 2876 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 39 PID 2112 wrote to memory of 2876 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 39 PID 2112 wrote to memory of 2876 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 39 PID 2112 wrote to memory of 2876 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 39 PID 2112 wrote to memory of 1060 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 40 PID 2112 wrote to memory of 1060 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 40 PID 2112 wrote to memory of 1060 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 40 PID 2112 wrote to memory of 1060 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 40 PID 2112 wrote to memory of 2872 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 41 PID 2112 wrote to memory of 2872 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 41 PID 2112 wrote to memory of 2872 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 41 PID 2112 wrote to memory of 2872 2112 MV TBN CALL PORT FOR LOADING COAL_pdf.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dpRbrdOWQX.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpRbrdOWQX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEADC.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV TBN CALL PORT FOR LOADING COAL_pdf.exe"2⤵PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56c167b2f9c7ca4570393606afe5aac02
SHA18f42970a86fecc7b328405f241b51301ddcd75c5
SHA25627bc3c0f4dac26e2d24824ba6526fb4a9d6d1a54164b6c269a19969aaa1486ed
SHA512830c8dbaf4bdcadf7e837dfb83a90cde78afac348ddcbfa92fa0be8c082975c673f7ea33dee10f6aefa50de30e6e6dc9ffda95c36a9f228cefcc784c9790532e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I4C2TD2SKFB8GN5WA75Q.temp
Filesize7KB
MD53e39411f2c6a7af5ee83417ec7c88dbb
SHA1b0036790e57a787936b89b00c3a3ff3c432369b8
SHA256b09fe19164e8b9ae8e223ea99a8c798e713ff1b9693e48e0fe9c7d68d11823fc
SHA5126cc407b2850553930bcfeb9d3568cc39db3d2514ee3b49890cdb136519d8a50d377f810a9089eaf213cb5e894a0b047c7cba8bc04e408a49a95cddd0c9f3a074