Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Settlement_Payment_Advise_pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Settlement_Payment_Advise_pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
Settlement_Payment_Advise_pdf.exe
-
Size
815KB
-
MD5
f301fd124e4a1e98a0940a6897174c9d
-
SHA1
b7524db5c28cf5174272ed230c620c6b1120b04d
-
SHA256
d7b641d0151a05ea88a81ce63ba1f8dec700c584203b3978daa4e143af7bfac4
-
SHA512
8228ed551aa5d9f86c417cdbd19c1a3facb2bd545367c1db5b07b7048acdba6ed8b664ea70f7686e127a457f1c66ff7f188a2f0c1ae45e45e1033d6c9da03566
-
SSDEEP
24576:PVTcsrgw74/EeWZAULhyeT7W2Gnm3Tw2a:PVcOgDslBVS2Gnm3THa
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in Windows directory 1 IoCs
Processes:
Settlement_Payment_Advise_pdf.exedescription ioc process File opened for modification C:\Windows\Brackishness.Ops Settlement_Payment_Advise_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Settlement_Payment_Advise_pdf.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Settlement_Payment_Advise_pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2236 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2236 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Settlement_Payment_Advise_pdf.exedescription pid process target process PID 2520 wrote to memory of 2236 2520 Settlement_Payment_Advise_pdf.exe powershell.exe PID 2520 wrote to memory of 2236 2520 Settlement_Payment_Advise_pdf.exe powershell.exe PID 2520 wrote to memory of 2236 2520 Settlement_Payment_Advise_pdf.exe powershell.exe PID 2520 wrote to memory of 2236 2520 Settlement_Payment_Advise_pdf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Tilluk=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\Bountihead.Amp';$Accustomedness=$Tilluk.SubString(78627,3);.$Accustomedness($Tilluk)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-