Overview

overview

10

Static

static

RFQ Order ...df.exe

windows7_x64

3

RFQ Order ...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 22:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ Order - Mediform S.A_pdf.exe

  • Size

    757KB

  • MD5

    703768db14ef6f320717c372f11f91b0

  • SHA1

    6502f1b42595f1c7c0fdafab681e6f66ec59222e

  • SHA256

    e72bbdfcc56339eb2aca00e01162d7fdd1004d9992150f2dea1b014d6b4469ac

  • SHA512

    8e28874a6c1a3b19395060875c3591a878f4110accc91ec021f552f6f8a71f56fb0a3e549c48c55d5cabc3a0a87174ff31ef9310c03e5f512f29b4b726cdb83a

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iCgcnOUGNbkHS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5E4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1820
    • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
      2⤵
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
        2⤵
          PID:668
        • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
          2⤵
            PID:1804
          • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
            2⤵
              PID:1688
            • C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe
              "C:\Users\Admin\AppData\Local\Temp\RFQ Order - Mediform S.A_pdf.exe"
              2⤵
                PID:1624

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpF5E4.tmp
              Filesize

              1KB

              MD5

              8def79ffd08c36e52ff74d34fe40fd26

              SHA1

              f1c97aba82563f78954a57abeffce83e89505450

              SHA256

              f247268f4ba04deb1ab876c230a36740a2deb33ffcbb29caf496dc4fc9c65eca

              SHA512

              e8a2b227c167e707e816937a1f1b7af61718842d12f942730023852af84e7d92a3b3ff8dd080496799054188515d481b33a0f0cf4c48d215cdc99a9c039ff557

              Download Submit

            • memory/1704-54-0x00000000003D0000-0x0000000000494000-memory.dmp

              Filesize

              784KB

              Download

            • memory/1704-55-0x0000000076241000-0x0000000076243000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1704-56-0x00000000002B0000-0x00000000002C2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/1704-57-0x0000000002170000-0x00000000021E4000-memory.dmp

              Filesize

              464KB

              Download

            • memory/1704-58-0x0000000004450000-0x00000000044AA000-memory.dmp

              Filesize

              360KB

              Download

            • memory/1820-59-0x0000000000000000-mapping.dmp

              Download