040b4146d9b0957fa1a8c9ef6356daafb3ba7a3a04a86d8f5cb51249158cd405

General

Target

Einreichung211117PDF.exe
Size

1022KB
MD5

1580c3b5db72184e363d5e8521462109
SHA1

c877974a5a9b2e16aa5741b037bce28e798f5d97
SHA256

0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b
SHA512

65f2ce88166edd7c4dc4a049135d9ffb7133b069847c1a730fc4eead2e14f368adbed22c4369e070c5fb932269d0ceb2daecdc0fc62b4bd06b67a89016643dd8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	Einreichung211117PDF.exe
1108	Einreichung211117PDF.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1108	Einreichung211117PDF.exe
1108	Einreichung211117PDF.exe
1108	Einreichung211117PDF.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1108	Einreichung211117PDF.exe
1108	Einreichung211117PDF.exe
1108	Einreichung211117PDF.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1892	1108	Einreichung211117PDF.exe	27
PID 1108 wrote to memory of 1892	1108	Einreichung211117PDF.exe	27
PID 1108 wrote to memory of 1892	1108	Einreichung211117PDF.exe	27
PID 1108 wrote to memory of 1892	1108	Einreichung211117PDF.exe	27
PID 1108 wrote to memory of 960	1108	Einreichung211117PDF.exe	32
PID 1108 wrote to memory of 960	1108	Einreichung211117PDF.exe	32
PID 1108 wrote to memory of 960	1108	Einreichung211117PDF.exe	32
PID 1108 wrote to memory of 960	1108	Einreichung211117PDF.exe	32
PID 1108 wrote to memory of 912	1108	Einreichung211117PDF.exe	31
PID 1108 wrote to memory of 912	1108	Einreichung211117PDF.exe	31
PID 1108 wrote to memory of 912	1108	Einreichung211117PDF.exe	31
PID 1108 wrote to memory of 912	1108	Einreichung211117PDF.exe	31
PID 1108 wrote to memory of 908	1108	Einreichung211117PDF.exe	30
PID 1108 wrote to memory of 908	1108	Einreichung211117PDF.exe	30
PID 1108 wrote to memory of 908	1108	Einreichung211117PDF.exe	30
PID 1108 wrote to memory of 908	1108	Einreichung211117PDF.exe	30
PID 1108 wrote to memory of 1224	1108	Einreichung211117PDF.exe	28
PID 1108 wrote to memory of 1224	1108	Einreichung211117PDF.exe	28
PID 1108 wrote to memory of 1224	1108	Einreichung211117PDF.exe	28
PID 1108 wrote to memory of 1224	1108	Einreichung211117PDF.exe	28
PID 1108 wrote to memory of 1228	1108	Einreichung211117PDF.exe	29
PID 1108 wrote to memory of 1228	1108	Einreichung211117PDF.exe	29
PID 1108 wrote to memory of 1228	1108	Einreichung211117PDF.exe	29
PID 1108 wrote to memory of 1228	1108	Einreichung211117PDF.exe	29

C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:912
- C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Einreichung211117PDF.exe"
  2⤵
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing