f681f08b89b710b8d32d08a6569629a6403459aa5256cc68e0e3d2b86934a221

General

Target

Factuur 00078454556-00398583.pdf.exe
Size

760KB
MD5

73b5b2675d4391fe6c59cc596bcd2a04
SHA1

4a598519786f3646d459ede621337e08d67c1b3f
SHA256

34400196b5de7adde8de4f2d8a5aadd350d1ce06910b9d44c1a17969c42b1b69
SHA512

9b0f5bf43ae7b001a40f9d2742c2558e6961e3058bd67ec92108cbe75dc088ec3cbc8afeb3bd88bb0d9042db36b66cc1cff1054235fdb3ae4d1b659f0e86114f
SSDEEP

12288:BDcMXv3/NEK7s37/shbOnMxrUzbtvC0nNr/Bqoo0Pamhyx/iugcGfAAChCJeTlV3:VpX/uqs37/s4MKrRZqLWaE6iUSDX2b

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
932	cyahede.exe
1604	cyahede.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 932 set thread context of 1604	932	cyahede.exe	91

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3352	1604	WerFault.exe	91
4428	932	WerFault.exe	87
1120	932	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Factuur 00078454556-00398583.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cyahede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cyahede.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00660030006500650063003500390066002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00660030006500650063003500390066002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-d01200000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{f0eec59f-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133727683743150095"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133727683745494125"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4904	Factuur 00078454556-00398583.pdf.exe
4904	Factuur 00078454556-00398583.pdf.exe
1604	cyahede.exe
1604	cyahede.exe
1604	cyahede.exe
1604	cyahede.exe
1604	cyahede.exe
1604	cyahede.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	cyahede.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	Factuur 00078454556-00398583.pdf.exe
932	cyahede.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 3048 wrote to memory of 4904	3048	Factuur 00078454556-00398583.pdf.exe	86
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 932 wrote to memory of 1604	932	cyahede.exe	91
PID 1604 wrote to memory of 804	1604	cyahede.exe	10
PID 804 wrote to memory of 1412	804	svchost.exe	99
PID 804 wrote to memory of 1412	804	svchost.exe	99

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1412

C:\Users\Admin\AppData\Local\Temp\Factuur 00078454556-00398583.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Factuur 00078454556-00398583.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\Factuur 00078454556-00398583.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Factuur 00078454556-00398583.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904

C:\Users\Admin\AppData\Local\Temp\cyahede.exe
C:\Users\Admin\AppData\Local\Temp\cyahede.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\cyahede.exe
  C:\Users\Admin\AppData\Local\Temp\cyahede.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 656
    3⤵
    - Program crash
    PID:3352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 676
  2⤵
  - Program crash
  PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 664
  2⤵
  - Program crash
  PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1604 -ip 1604
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 932 -ip 932
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 932 -ip 932
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Packages\xwtrgtd

Filesize
654B

MD5
b34ff9eb4ba3b32de1f67ca1af126c36

SHA1
2a96ea33d9634d3623c8390097179f210171486b

SHA256
efbc4ab1bcb163b8a058f5c5de9890178e2f9020eec5372ab51d6c2979847ee0

SHA512
9f5b60a845d4baded1c5ff240b71db3153810c39f18d21ccd2465a75bd2d94d6fc3db37596f44745a289cc3e44ce4ef7a3465521f5b4696a57146d5c02808194

Download Submit
C:\Users\Admin\AppData\Local\Temp\cyahede.exe

Filesize
760KB

MD5
73b5b2675d4391fe6c59cc596bcd2a04

SHA1
4a598519786f3646d459ede621337e08d67c1b3f

SHA256
34400196b5de7adde8de4f2d8a5aadd350d1ce06910b9d44c1a17969c42b1b69

SHA512
9b0f5bf43ae7b001a40f9d2742c2558e6961e3058bd67ec92108cbe75dc088ec3cbc8afeb3bd88bb0d9042db36b66cc1cff1054235fdb3ae4d1b659f0e86114f

Download Submit
memory/804-20-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-23-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-28-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-26-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-22-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-30-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-228-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/804-3375-0x0000000030CE0000-0x0000000030D57000-memory.dmp

Filesize
476KB

Download
memory/1604-17-0x00000000009D0000-0x0000000000C1B000-memory.dmp

Filesize
2.3MB

Download
memory/4904-4-0x0000000000B50000-0x0000000000D9B000-memory.dmp

Filesize
2.3MB

Download
memory/4904-2-0x0000000000930000-0x0000000000B4A000-memory.dmp

Filesize
2.1MB

Download
memory/4904-3-0x0000000000401000-0x00000000004A5000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing