9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b | Triage

Analysis

max time kernel
163s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 05:32

Sharing

Report Analysis Logs

General

Target

Pdfcore.exe
Size

85KB
MD5

195dbe2351eafab58eab820b6b1e282a
SHA1

c39729122a15f10bc1169f1873a0f4d67fda09c2
SHA256

2925ff88ea625ef40be73fab62e6749b6ab56444e668b86b5a6c190d2e0605c7
SHA512

abb12fcf1e5222bf0caaf983fcdbf946581ebb06307ee743bf4282d3332c795bcca2277db59c8e033f45c0f8999e6d1dff896c5dd4034b3fe949a463f648da37
SSDEEP

1536:6mW0gJSH4OtJAGRD/r2zkHLMAKJyGykyXRImXo5HG7BIUL:g0f4eUkHLQJV0ImXo5HcqUL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Pdfcore.exe
"C:\Users\Admin\AppData\Local\Temp\Pdfcore.exe"
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads