d0d523bb3e44390067122f5b4768ee44811c00f14a344dd70e71d4c2bcf4962d | Triage™

Analysis

max time kernel
19s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07/02/2022, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order-9411574-pdf.exe
Size 249KB
Sample220207-jwf5dshebr
SHA256 d0d523bb3e44390067122f5b4768ee44811c00f14a344dd70e71d4c2bcf4962d
MD5 58e91c804bf83bcb330d64d87bdd7abf
SHA1 9f00f81e64cbe3445a1f3f5f24976d736e8543ca
SHA512 aaf401d5f4a35325677ba978d170204d1305759c763b3d345d2817080cfb0707acb3703548f29db2c520faf3f2ba8835adeec435da59dfea1d3c03527f400ddb
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3624	Order-9411574-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Order-9411574-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order-9411574-pdf.exe"
1⤵
- Loads dropped DLL
PID:3624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads