79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

807364412 - detailedManifest·pdf.exe
Size

349KB
MD5

a1a804ad177c7ed334b5be2da145ff2f
SHA1

91f6e4a0be90c39dd42d68de1e33d24bf28b47db
SHA256

79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
SHA512

35ea2a0c66dbfce26f6a15971db14ba761cc5f9b956dcfb1c60062c1518c20faec17197bc7b1e09779fdd2147398f9dbe45fa1601e1c6f45d4b85ddac2db7c49
SSDEEP

6144:R/c/43AbmhXUQirdrt9ENYoTvGfKPGneuF+CPla9LvgQws18HOGCy853bSWeB/T:RR37XUTrdp9SYYOfKeneuFp6Lvgds18/

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

pid process

4548 807364412 - detailedManifest·pdf.exe
4548 807364412 - detailedManifest·pdf.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4548	807364412 - detailedManifest·pdf.exe
4548	807364412 - detailedManifest·pdf.exe

Drops file in System32 directory 2 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Antiantienzyme.Cur	807364412 - detailedManifest·pdf.exe
File opened for modification	C:\Windows\SysWOW64\Rosanilin\Forsigtighedsprincip\atropia\Guders.Trn	807364412 - detailedManifest·pdf.exe

Drops file in Windows directory 1 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Resistensproblemet\Crossleted\Ansgtes\Ridderlfterne232.Tet	807364412 - detailedManifest·pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4772 4548 WerFault.exe 807364412 - detailedManifest·pdf.exe

pid	pid_target	process	target process
4772	4548	WerFault.exe	807364412 - detailedManifest·pdf.exe

C:\Users\Admin\AppData\Local\Temp\807364412 - detailedManifest·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\807364412 - detailedManifest·pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1068
2⤵
- Program crash
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4548 -ip 4548
1⤵
PID:4132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk7C6A.tmp\Math.dll
Filesize
171KB

MD5
499788d1d4b70ea3499b6411ef5aca0c

SHA1
db7274f0c3beea8a2ed7df7fe3006b1ec965d13c

SHA256
6b6c63505ac093672cdc062ea23ea8fbb263204c9591c936dda896cba2c56504

SHA512
c566e94acf0d0de820fb2e7661b721a6fd23c6c5fe7b551b48e80b3c24b0d8de379fa2c53a653858e69dd0a8f6b98bf68a6d7425342f1ade1602ddaa2310c549

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7C6A.tmp\System.dll
Filesize
12KB

MD5
6c38da8922cc37b4bbb77de4a63ad843

SHA1
4e0533fd11df8bddbd543ed58df7b6060d9f4631

SHA256
1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1

SHA512
ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430

Download Submit