Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 06:31

General

  • Target

    MCB_09252024.pdf.exe

  • Size

    940KB

  • MD5

    d0ea74bc92edf6c15ec891218fa6ec82

  • SHA1

    9e16672d91e4eceb3ceb6c4592baba252ee56edf

  • SHA256

    a947fb714131dc2a3ebdbab989f241713e51d629e00b292b5e6111e8c1506ae3

  • SHA512

    d3e025fe052104b88970e3efbc7dd174bd0d0965b977f3f1a4274f7302a000b54c4f41824963ef2f393bcf30f0e0760e1f822cb02ffb7956f26a08a430b58d94

  • SSDEEP

    12288:83FQovvvDg6BCQC+5MnwNJhW3EFPwUpkFhCNQB4UOWTFqeUOlv/y/FUsjtzVbiSg:8GGvvM6RCwNNyEFPNOZOWTF32Usjj6

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MCB_09252024.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\MCB_09252024.pdf.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATQBDAEIAXwAwADkAMgA1ADIAMAAyADQALgBwAGQAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABNAEMAQgBfADAAOQAyADUAMgAwADIANAAuAHAAZABmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABHAHgAcwBuAHoAdQBoAGUAdAB3AHcALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwB4AHMAbgB6AHUAaABlAHQAdwB3AC4AZQB4AGUA
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 868
      2⤵
      • Program crash
      PID:6032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2684-39-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-3-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-2-0x0000000004F40000-0x0000000005028000-memory.dmp

    Filesize

    928KB

  • memory/2684-37-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-15-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-31-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-29-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-27-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-25-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-23-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-35-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-19-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

    Filesize

    4KB

  • memory/2684-14-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-12-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-10-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-8-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-6-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-4-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-33-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-21-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-1-0x00000000001B0000-0x00000000002A2000-memory.dmp

    Filesize

    968KB

  • memory/2684-17-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-41-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-43-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-53-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-51-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-49-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-47-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-45-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-55-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-57-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-59-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-61-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-63-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-65-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-67-0x0000000004F40000-0x0000000005023000-memory.dmp

    Filesize

    908KB

  • memory/2684-1080-0x0000000004260000-0x00000000042AC000-memory.dmp

    Filesize

    304KB

  • memory/2684-1079-0x00000000020A0000-0x0000000002104000-memory.dmp

    Filesize

    400KB

  • memory/2684-1078-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-1087-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2684-1084-0x0000000005680000-0x00000000056D4000-memory.dmp

    Filesize

    336KB

  • memory/2684-1086-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

    Filesize

    4KB

  • memory/5896-1083-0x0000000002A50000-0x0000000002A90000-memory.dmp

    Filesize

    256KB