Overview

overview

10

Static

static

1

RT 009435 ...B).exe

windows7_x64

10

RT 009435 ...B).exe

windows10-2004_x64

7

Analysis

  • max time kernel
    25s
  • max time network
    77s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    07-02-2022 08:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RT 009435 PO-20220207.pdf(78KB).exe

  • Size

    344KB

  • MD5

    2c9e55d24d5853836195834ea08d31ba

  • SHA1

    d4b531649a46e252dbaa6bdb279b9dc18d8b3bd4

  • SHA256

    524881f1bcc00d0a27ab7829b776e32844b3e9f19cea0bfae32b95a6a8006ffc

  • SHA512

    8fe29a8a484016b335ceb85d417f0375d59f5e2995c734d65cf8c4c10b787520cf1bca6475d6b07cb027b5410fe8155003c0668d70b4b7eb21be31fbdd8644cd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\RT 009435 PO-20220207.pdf(78KB).exe
    "C:\Users\Admin\AppData\Local\Temp\RT 009435 PO-20220207.pdf(78KB).exe"
    1⤵
    • Loads dropped DLL
    PID:492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nszBC89.tmp\vrhlgxyny.dll
    MD5

    b9754bd6784133e70c5fbc565ba101f4

    SHA1

    2340f706dd48dabd1144f454c301bc5e87e63cc3

    SHA256

    18cc02c2c6cb2fee75e422163bbafbfc42cce7a191d5364f8b34767b833649ae

    SHA512

    d4dba9d0557c8c12f57ce2230b7fae9bf95e408f54af6a9cc1cb7b1657d711960d66e20c21a46b2caa69b2181b8eb175b81e03128dd2d900b6d1dffe911459f5

    Download Submit