8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3

Analysis

max time kernel
148s
max time network
165s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
Size

18KB
MD5

0a6ef0779b91000bc5c1a84b4843f3b0
SHA1

ffacae95ce6ccf791688bacccb99c8b07f44cabb
SHA256

8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3
SHA512

0027b2d3a8549ca5077005db0b7685c3de8648541ef343e08137ae741b9d09b3d7015c4d60165d80a8924c17f1da0e088d6ad8191f4b876bbe41a047a34b6b18
SSDEEP

192:Mcbkdw86m00Q96odRNyCiq/xEDvJ5Ao5iFVpUX7ZUSoQkC4duC8ffb1Ettz:BkSnmQgodRN5iqEDvTwFVm91kChhEttz

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
948	viewpdf_updater.exe

Loads dropped DLL 4 IoCs

pid	Process
2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
948	viewpdf_updater.exe
948	viewpdf_updater.exe
948	viewpdf_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28
PID 2004 wrote to memory of 948	2004	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	28

C:\Users\Admin\AppData\Local\Temp\8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
"C:\Users\Admin\AppData\Local\Temp\8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
memory/948-56-0x0000000000000000-mapping.dmp

Download
memory/948-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2004-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/2004-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download