8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef

Analysis

max time kernel
225s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Urgent quote request -pdf-.exe
Size

812KB
MD5

ce411b2f7dfd407c1a546e160193b55d
SHA1

c061262cf1a7999d7ee59694dd0c8bb570987e02
SHA256

8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef
SHA512

af96c79b2af92840691a777a72e650c0763f0bc20ecd8d1970ac97cdd5048768fbe413dbd7d673f03f53bcace92d517eeb17b9a791c4c29fa4463b6a8c9c51ba
SSDEEP

12288:h2D2DHPXsU51ZM0W52nCrgxRzrzbH3sgGJy3i9zxihIg95lvTHRyoY:Q2DPugfrzbHcFJwIohIgvpjRpY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2000 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

876 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 876 powershell.exe

pid	process
2000	schtasks.exe

pid	process
876	powershell.exe

description	pid	process
Token: SeDebugPrivilege	876	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Urgent quote request -pdf-.exe

description	pid	process	target process
PID 1524 wrote to memory of 876	1524	Urgent quote request -pdf-.exe	powershell.exe
PID 1524 wrote to memory of 876	1524	Urgent quote request -pdf-.exe	powershell.exe
PID 1524 wrote to memory of 876	1524	Urgent quote request -pdf-.exe	powershell.exe
PID 1524 wrote to memory of 876	1524	Urgent quote request -pdf-.exe	powershell.exe
PID 1524 wrote to memory of 2000	1524	Urgent quote request -pdf-.exe	schtasks.exe
PID 1524 wrote to memory of 2000	1524	Urgent quote request -pdf-.exe	schtasks.exe
PID 1524 wrote to memory of 2000	1524	Urgent quote request -pdf-.exe	schtasks.exe
PID 1524 wrote to memory of 2000	1524	Urgent quote request -pdf-.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KLDxttbPfKRi.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KLDxttbPfKRi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3EB6.tmp"
2⤵
- Creates scheduled task(s)
PID:2000

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3EB6.tmp
Filesize
1KB

MD5
dc3e58609d6305cdd6befffa52a5c1f7

SHA1
de7b37d4f7496321f25ba91d2bfb54c09797f018

SHA256
ffecca14fbfe416bfe62eab6809e7b36249b7b0daa8b0a366e9942f1801bce43

SHA512
544617a5f66af348317d1cfd6d0033c197d54f921ba7bfc6f4157938610d3c9fc551a3d0e920d9d08684f80227a4d2fbbe1d3130ca2faf7659e9779062341d39

Download Submit
memory/876-59-0x0000000000000000-mapping.dmp

Download
memory/876-63-0x000000006E7F0000-0x000000006ED9B000-memory.dmp

Filesize
5.7MB

Download
memory/876-64-0x000000006E7F0000-0x000000006ED9B000-memory.dmp

Filesize
5.7MB

Download
memory/1524-54-0x0000000000360000-0x0000000000432000-memory.dmp

Filesize
840KB

Download
memory/1524-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x0000000000520000-0x0000000000536000-memory.dmp

Filesize
88KB

Download
memory/1524-57-0x00000000006F0000-0x00000000006FE000-memory.dmp

Filesize
56KB

Download
memory/1524-58-0x0000000005EB0000-0x0000000005F1E000-memory.dmp

Filesize
440KB

Download
memory/2000-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads