b71e123f35a70fe444f019c9b94fa65c383d14eced3647bb13ac4e50ec810af8

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMENDED CONTRACT-pdf.exe
Size

749KB
MD5

0dd2464556b15a0110a61fbb9c059fd7
SHA1

85dc6648297ce3a175c87f90ad87c0c19940f7ec
SHA256

ec718f7c0b27972083cd3990267d68a2cebd76b6fcaa224c44f3b165d95125f3
SHA512

7a46b3ac69acdc85cfd54be576144035ef844cb64ac4a918735e1bf96fd1785e9c2d13e6d93424689397e3a89b879385638d3d96386d9ba49742b69271f4e23c
SSDEEP

12288:TA4AyshjrfD3NfhN3ImdnkOMR4vejLiuLbKc+z6ps:TA4A/hfDJ3IokOMR4vaiu68s

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

AMENDED CONTRACT-pdf.exe

pid process

2208 AMENDED CONTRACT-pdf.exe
2208 AMENDED CONTRACT-pdf.exe
Drops file in Program Files directory 1 IoCs

Processes:

AMENDED CONTRACT-pdf.exe

description ioc process

File opened for modification C:\Program Files (x86)\Common Files\Valgbestyrelse177\Voicing.Psy AMENDED CONTRACT-pdf.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2488 powershell.exe
2640 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2488 powershell.exe
2640 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2488 powershell.exe
Token: SeDebugPrivilege 2640 powershell.exe

pid	process
2208	AMENDED CONTRACT-pdf.exe
2208	AMENDED CONTRACT-pdf.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Valgbestyrelse177\Voicing.Psy	AMENDED CONTRACT-pdf.exe

pid	process
2488	powershell.exe
2640	powershell.exe

pid	process
2488	powershell.exe
2640	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AMENDED CONTRACT-pdf.exe

description	pid	process	target process
PID 2208 wrote to memory of 2488	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2488	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2488	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2488	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2640	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2640	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2640	2208	AMENDED CONTRACT-pdf.exe	powershell.exe
PID 2208 wrote to memory of 2640	2208	AMENDED CONTRACT-pdf.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\AMENDED CONTRACT-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\AMENDED CONTRACT-pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle minimized "$hydroxamic=Get-Content 'C:\Users\Admin\AppData\Roaming\Njeregnende130\Ramular.Ung';$Rammes=$hydroxamic.SubString(51368,3);.$Rammes($hydroxamic)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle minimized "$hydroxamic=Get-Content 'C:\Users\Admin\AppData\Roaming\Njeregnende130\Ramular.Ung';$Rammes=$hydroxamic.SubString(51368,3);.$Rammes($hydroxamic)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q83HP68E9J9F49S6FTXQ.temp
Filesize
7KB

MD5
518c10c9cd4410401212d45cde8e3f16

SHA1
67af039f0ef0f90bebb29fd62badbdf194188c6c

SHA256
4810b7c136e183b26b494030e7b7c39c736bc9c775c118074a573d78d73e244a

SHA512
a1264561c2dee920da507bdc6e6be6d2d626a86dc867bf7fa03afa36120ec96a33f1f26116c8b87ebc50162901c7be1920303159f9d0e8e77aced2a09b7148d5

Download Submit
\Users\Admin\AppData\Local\Temp\nso2203.tmp\nsExec.dll
Filesize
6KB

MD5
b5a1f9dc73e2944a388a61411bdd8c70

SHA1
dc9b20df3f3810c2e81a0c54dea385704ba8bef7

SHA256
288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884

SHA512
b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8

Download Submit
memory/2488-11-0x00000000742D1000-0x00000000742D2000-memory.dmp

Filesize
4KB

Download
memory/2488-12-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-13-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-14-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-15-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-16-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download