1bab67596abed809b1daad1c32afa1866c090e72c28e3542f90ac468e33cd617

General

Target

Würth factura 4052299769.PDF.exe
Size

757KB
MD5

c4da846cd671f4f992c3bcef32684747
SHA1

a0d88c6636c2fbc77553eaf628f8b3380edb831f
SHA256

0db03e42aae3a3fde2281d82c6b945a6ade7b4779692e144c77d95ea614fc335
SHA512

cc1cd50209b02a4812039f5b94384229dcd8edbca2aee3882c4d59be04ac600d30062cc37f8560a1e144b3c1f7fcad3a91ea3750720826c2aa3788951ea3bf17
SSDEEP

12288:+PgQ7v2gNUkDRtE6nlQ3k2orL/Ksqr8uBWIbyuwQL3OWntl81tTTZ/Oi5DwFyEif:yjNzDRtbQ02or+H5yRQLvf81BV2m6io+

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2964	powershell.exe
2324	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\folkepensionsaldres\frostbiter.ini	Würth factura 4052299769.PDF.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Stilting.Bra	Würth factura 4052299769.PDF.exe
File opened for modification	C:\Program Files (x86)\unprobably.ini	Würth factura 4052299769.PDF.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Levitters.lnk	Würth factura 4052299769.PDF.exe
File opened for modification	C:\Windows\Levitters.lnk	Würth factura 4052299769.PDF.exe
File opened for modification	C:\Windows\resources\beent.elv	Würth factura 4052299769.PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Würth factura 4052299769.PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	powershell.exe
2964	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	Würth factura 4052299769.PDF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2324	3060	Würth factura 4052299769.PDF.exe	30
PID 3060 wrote to memory of 2324	3060	Würth factura 4052299769.PDF.exe	30
PID 3060 wrote to memory of 2324	3060	Würth factura 4052299769.PDF.exe	30
PID 3060 wrote to memory of 2324	3060	Würth factura 4052299769.PDF.exe	30
PID 3060 wrote to memory of 2964	3060	Würth factura 4052299769.PDF.exe	33
PID 3060 wrote to memory of 2964	3060	Würth factura 4052299769.PDF.exe	33
PID 3060 wrote to memory of 2964	3060	Würth factura 4052299769.PDF.exe	33
PID 3060 wrote to memory of 2964	3060	Würth factura 4052299769.PDF.exe	33

C:\Users\Admin\AppData\Local\Temp\Würth factura 4052299769.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Würth factura 4052299769.PDF.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Copresidents149=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\Stragglier\Xylophone\navnerkkers.Kry';$Forehavendernes=$Copresidents149.SubString(53933,3);.$Forehavendernes($Copresidents149)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Copresidents149=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\Stragglier\Xylophone\navnerkkers.Kry';$Forehavendernes=$Copresidents149.SubString(53933,3);.$Forehavendernes($Copresidents149)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DOQJFZRKOA2B458BW5Q3.temp

Filesize
7KB

MD5
86a371a4d5da397ae3f11b4c1514b9cc

SHA1
a972e679642a10a46d7ed28fb3d9502c0b87fc5d

SHA256
24684457f0eb5e3bbc32e7d15c46dce98542b3e549e964b0d68ba27c1f81258b

SHA512
8b0fba21f4915ecc6ce0cac18acfe86bfa7bf0a9cd9a313e35d87539a2b6c0105fdfdbaf25950f03f8d6b3889511578ae528f5148b8480c036edc037196152ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3c9f684d22a03ccc866afc689c96e908

SHA1
873839e751edb7b1181462eedcf7f382bb2e611e

SHA256
bf3ec3e68ee958372689c8ed587818dc9258dd467e19ef48364fcd54a92031cf

SHA512
2cb84b4019e28d5cd158421ebbf81c0907a4faa429246834d7bfc03d811b1286b6ad5661a42c4da03dbe4de7c6e8d75286c3b254a9c1b9afc9475d79f338e5c7

Download Submit
memory/2324-16-0x0000000074381000-0x0000000074382000-memory.dmp

Filesize
4KB

Download
memory/2324-18-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-17-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-19-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-20-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing