Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 10:13
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR BID 06-09-2022·pdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
REQUEST FOR BID 06-09-2022·pdf.exe
Resource
win10v2004-20220812-en
General
-
Target
REQUEST FOR BID 06-09-2022·pdf.exe
-
Size
559KB
-
MD5
b794d1262f443b4e8ee47e513ca542f9
-
SHA1
9a586d9929b816f73b92c798348f2ae223c3ad22
-
SHA256
faeb846f5c806316e74d1961fbdeccb4842b58fa3c9a431d29ec1ffb37340a98
-
SHA512
f6d84d4bcaad7508521c93b75778c335e256f91f913524311836ce198519d1d2665aaf56dc19ca9fe54fb6efcd38c10e513660bcd27dd77c8e4609b13c3096f4
-
SSDEEP
12288:K0SKoJ47FnBVsfXx62E+rwr5Do1Q3buie+Dhhr0ZTPHnIDqmhQmuto8:DLocFnBSXfk1JfeeXr0ZHIFao8
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
REQUEST FOR BID 06-09-2022·pdf.exepid process 1864 REQUEST FOR BID 06-09-2022·pdf.exe 1864 REQUEST FOR BID 06-09-2022·pdf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
Processes:
REQUEST FOR BID 06-09-2022·pdf.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Pterygopharyngeal\Magnoliers.Ral REQUEST FOR BID 06-09-2022·pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1668 1864 WerFault.exe REQUEST FOR BID 06-09-2022·pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR BID 06-09-2022·pdf.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR BID 06-09-2022·pdf.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 10722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1864 -ip 18641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nseDE80.tmp\Math.dllFilesize
169KB
MD566f2ce4302893b92295223ed9b5e5e5e
SHA1e27dc596fe1e2fa5416f3f490c6f2f0b9b5b3077
SHA2562b05d1dfcf3a57ac6e6ef326611a13f8934b9c56d4e75d65d5e301d2793e09bb
SHA51238aa695cd86d38af41dfe444faf46707e28141ed1fea636d515fc785a15eadc560a6a30270fde2e5a759dec4d1ff4ee22b5079fd21312eff5974cac76b9720b7
-
C:\Users\Admin\AppData\Local\Temp\nseDE80.tmp\System.dllFilesize
11KB
MD52e07bbddc0912b77cac77afe9d9035ee
SHA133a4646191dd25c034b5223ebfed761969301710
SHA25697ace5ce4e05225db3c1345a2d1b5fa7d2281bb51fc5aa2d34c186befa9e000f
SHA51256c5793b01a1e5c356db005d9833d4c6f703204cff5dbb4613620cd1a90ef5acf91c3e7654295e9f63732a104d83fb471483c188449d75d8c009a81a544fe388