304f5efef824e75c6a8c2ddb7ff9a3a5098751ed219ddd07f7a828251f72ce9c

Analysis

max time kernel
160s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQ BILANCIA.PDF.exe
Size 552KB
Sample220720-xama6sffak
SHA256 304f5efef824e75c6a8c2ddb7ff9a3a5098751ed219ddd07f7a828251f72ce9c
MD5 5e7e44d895a048ae2b78a03bd63423f8
SHA1 ef8bf156f36df8fc66bf2b8f74651a42dc5d3cef
SHA512 8b31599fcc62cca4603c075a9167c0dafefebb5dc7b5194e713e03959694454ecfcea1b1610f2ebbe07028a2487cdba578761f163d4a0e4e6844108e6b467ffd
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Application.lnk	INQ BILANCIA.PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	1620	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	INQ BILANCIA.PDF.exe

C:\Users\Admin\AppData\Local\Temp\INQ BILANCIA.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\INQ BILANCIA.PDF.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1836
  2⤵
  - Program crash
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1620 -ip 1620
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-130-0x00000000004F0000-0x0000000000580000-memory.dmp

Download

memory/1620-131-0x0000000004F30000-0x0000000004FCC000-memory.dmp

Download

memory/1620-132-0x0000000005580000-0x0000000005B24000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads