c886caf4fcc4d07389d528bdbe845f59d97d86299ee8b88c1fc6256599811187

Analysis

max time kernel
66s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2023 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INVOICE.213557783.pdf.exe
Size

380KB
MD5

283cca8b87929c51ad0d39efc3ca3498
SHA1

014da20b7ffe1e63191b15654e4740a160835415
SHA256

c886caf4fcc4d07389d528bdbe845f59d97d86299ee8b88c1fc6256599811187
SHA512

5d115cc72ba5e72144aba373f75818f36d240f3864b7c13492fd72c32f6ea3693c19981dd4cff3e6e9b31b3ff8a84ea17f2d60e4d16db571a0cb0cb986013113
SSDEEP

6144:mmOPknppppppppppbpppppppppBz+pRjxpQpKyrFdBJxYfmAheWLA5TVvgGGoDCl:9pppppppppbppppppppponxpQpKyrFzo

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1796	INVOICE.213557783.pdf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Halvbuerne.Bar	INVOICE.213557783.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\INVOICE.213557783.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.213557783.pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Templates\Underfundigheder.lnk

Filesize
800B

MD5
a1c7a137a254db998efd3eeef1ee4b92

SHA1
1cebf9434e29f83195a088fd011c286b009992b4

SHA256
4783a5886103c29677565361a7278e44d42aece1c1b259f57296172636b70274

SHA512
ba18de3fa917ec48d7fb7807978d026bd2b4719e66ccd88e22ee72bf4b8fb019156b17fb9f514d5e4d71d55527f7abb955b913e4c3af4916593587549aa715df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7D83.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit