Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09-02-2023 07:15

General

  • Target

    SOLICITUD DE COTIZACIÓN 020823_PDF_pdf.exe

  • Size

    372KB

  • MD5

    3b1eee1eae44b69580a51f62892299b6

  • SHA1

    97b9a975bb3300c24eec2cfc72487cbc53c250a0

  • SHA256

    a5a7cd96d20f9dcae8e052a5fb71ffa0b5d9573ddcc85ee4d651724b0f450e1b

  • SHA512

    35bbc3bac0d3b08ad7f918de400f57636199e2fa9cdfbbbc9924514c6d5f5f460aabf7f0a133e3db7d8e614ed28bb1504c856fe47c5d49ab60b07dcc4eba19bb

  • SSDEEP

    6144:SPXUVQiwqrcTSBp43Fg7XFWjiFyItJyIp7+x/CXm6QS3j5eA7zvbbN:rxrcTd08jiFyopixqXlf53vbN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN 020823_PDF_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN 020823_PDF_pdf.exe"
    1⤵
    • Loads dropped DLL
    PID:1548

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nso64DE.tmp\System.dll

    Filesize

    11KB

    MD5

    34442e1e0c2870341df55e1b7b3cccdc

    SHA1

    99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

    SHA256

    269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

    SHA512

    4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

  • memory/1548-54-0x0000000075561000-0x0000000075563000-memory.dmp

    Filesize

    8KB

  • memory/1548-56-0x0000000003980000-0x0000000009284000-memory.dmp

    Filesize

    89.0MB

  • memory/1548-57-0x0000000003980000-0x0000000009284000-memory.dmp

    Filesize

    89.0MB