7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e

Analysis

max time kernel
150s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23/09/2022, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ebook_Limit_Order_Book.pdf.exe
Size 2.5MB
Sample220923-ff89fshahn
SHA256 7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
MD5 acdfaf2d9b94f13f469a679f1776bcf2
SHA1 61fe1b627fe4467b64e5881e603ced520908484b
SHA512 907d8111c9f359cfe3922876620e72ca68cb4eb1b96074b50e18f196cebeff1348561f007ca31332fc3e642342969198beac66cfb5ae3cb8d0fdff935d0519fe
SSDEEP 49152:7B9Xmlxc1jEc05RiyP7hVHR9CbYdTqNBbn5FryvL6O:F8l+Wc4FrHn/qNBT42O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1316	1280	Ebook_Limit_Order_Book.pdf.exe	27
PID 1280 wrote to memory of 1316	1280	Ebook_Limit_Order_Book.pdf.exe	27
PID 1280 wrote to memory of 1316	1280	Ebook_Limit_Order_Book.pdf.exe	27
PID 1280 wrote to memory of 1316	1280	Ebook_Limit_Order_Book.pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\Ebook_Limit_Order_Book.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Ebook_Limit_Order_Book.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\verifica_spid.pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

verifica_spid.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\verifica_spid.pdf
Size 252KB
SHA256 c55c43386176a00ac7874117fd9535afd71b474669e63da19d89c57b819c54e1
MD5 f3e24dcc744c0283c3491cddc7ff763d
SHA1 aff25d3a3dc5b34580c995394529ef74625ae8bb
SHA512 99e70fded33883face67c270ee2140c396cbe01c552340fab5dc65158f098cb222cc1987cbfeb90aa701ba28032906fa16e0563544dab47b3c32a664b3cdc021
SSDEEP 6144:nPOmw43KNFsaw9fwSCLqx8GtKRIzZQux2Wa:dw4anshRwSgySeQq2Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmp

Download