Overview

overview

10

Static

static

1

IRQ2107799_pdf.exe

windows7_x64

10

IRQ2107799_pdf.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    13/04/2022, 09:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IRQ2107799_pdf.exe
  • Size 417KB
  • Sample220413-kz463aaggr
  • SHA256 78680346bd7cc7206f96c624c19cfe2adff4d06bfa651016a4f0a744f808a260
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IRQ2107799_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\IRQ2107799_pdf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe
      C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe C:\Users\Admin\AppData\Local\Temp\jucavlckpd
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe
        C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe C:\Users\Admin\AppData\Local\Temp\jucavlckpd
        3⤵
          PID:2700

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          bri67puv27it5
          • Path C:\Users\Admin\AppData\Local\Temp\bri67puv27it5
          • Size 210KB
          • SHA256 cdeec9d2e3e40e638956513228b9801525961037cccef98d7141b92cc8e07ed0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          hdujqefqf.exe
          • Path C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe
          • Size 70KB
          • SHA256 ab3d3f66ad294ef9c91cd499daa1f84dd68e016b83a1f42ad773e363a78ce0fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          hdujqefqf.exe
          • Path C:\Users\Admin\AppData\Local\Temp\hdujqefqf.exe
          • Size 70KB
          • SHA256 ab3d3f66ad294ef9c91cd499daa1f84dd68e016b83a1f42ad773e363a78ce0fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jucavlckpd
          • Path C:\Users\Admin\AppData\Local\Temp\jucavlckpd
          • Size 4KB
          • SHA256 985ce51799c238cefa3b131486e93aefee3c145bfaf05fee4fa557c165477df1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download