32202111654172f16eab4a33849af61e651680218d44e657b719b56789976561

Analysis

max time kernel
20s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-01-2022 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order-711493-pdf.pif.exe
Size

296KB
MD5

7dc82eb8ad4d78c1fb2534eef4fb10fd
SHA1

a6f61ab9754a38151026dd6e94a97459723c8add
SHA256

32202111654172f16eab4a33849af61e651680218d44e657b719b56789976561
SHA512

7365a7a32a8c0227c70c93cc51a7a9235606af4c27acdceb531766dfad57b6f481f850b173f542c846d899f2172d60c8580f3febe3516d512500d3662fa92513

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

Order-711493-pdf.pif.exe

pid process

448 Order-711493-pdf.pif.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order-711493-pdf.pif.exe

description pid process target process

PID 448 set thread context of 3288 448 Order-711493-pdf.pif.exe Order-711493-pdf.pif.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
448	Order-711493-pdf.pif.exe

description	pid	process	target process
PID 448 set thread context of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Order-711493-pdf.pif.exe

description	pid	process	target process
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe
PID 448 wrote to memory of 3288	448	Order-711493-pdf.pif.exe	Order-711493-pdf.pif.exe

C:\Users\Admin\AppData\Local\Temp\Order-711493-pdf.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Order-711493-pdf.pif.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Local\Temp\Order-711493-pdf.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Order-711493-pdf.pif.exe"
2⤵
PID:3288

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nssB882.tmp\klgtagbqxcl.dll
MD5
099043310c3f814bd0fb860794a9a84a

SHA1
621769796ca94414f7c219e0da65fa4a72549d33

SHA256
ef99d64e0fba1adc021866b880b3b07c9ba523d9fda5766aa548304adaf97de5

SHA512
c1d9a0ea9c1918a9efede6a67aa982ab68d6ce0fd3381d5a02ba89fd35f8fa317f9a7563cbd95d8d1c0ca651dae92ad67596f1dd2651c741e2596f9654fb70dc

Download Submit
memory/3288-132-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download