Analysis
- max time kernel
191s - max time network
239s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/05/2022, 11:13
General
- Target 3532CORDERCONFIRMATION,pdf.exe
- Size 666KB
- Sample220516-nbd7hsbfgq
- SHA256 e0896f3de4452ba8a69e37e0449fbbbca187f7cadd1dffeef70a8e55f2ae6e6f
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3532CORDERCONFIRMATION,pdf.exe"C:\Users\Admin\AppData\Local\Temp\3532CORDERCONFIRMATION,pdf.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2016-130-0x0000000000B50000-0x0000000000BFC000-memory.dmp
memory/2016-131-0x0000000005B30000-0x00000000060D4000-memory.dmp
memory/2016-132-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/2016-133-0x00000000056C0000-0x00000000056CA000-memory.dmp
memory/2016-134-0x0000000007A50000-0x0000000007AEC000-memory.dmp
memory/2016-135-0x0000000005900000-0x0000000005966000-memory.dmp