Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system - submitted
03/07/2023, 09:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KIEFEL Packaging GmbH Purchase Order.exe
Resource
win7-20230621-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
KIEFEL Packaging GmbH Purchase Order.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target KIEFEL Packaging GmbH Purchase Order.exe
- Size 258KB
- Sample230703-lc2m4aha9v
- SHA256 2ac28f2913c6e2d231d0b67b49a3491f4046221a42ca349f586e0532ac257575
- MD5 8d276ee3362001b72a013859101e510a
- SHA1 003cab48fe55d9e5a6694d29f2492cd1678fbc92
- SHA512 75e315832f286eeef283e42a39c8d16b0818d147d6c9fb562bb5981593bda2af8edadd73a0ed9c6519734eb263b22d94c108f0d4e814d9dbe98c2fb7401e00a4
- SSDEEP 6144:/Ya6B8BZlDcjKX1O1UOptR2vqxBcw+YVUul/JNdRhmOQzEY:/YT8z9NXcGDqQcGm/pRhgoY
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation KIEFEL Packaging GmbH Purchase Order.exe - Loads dropped DLL 1 IoCs
pid Process 2128 KIEFEL Packaging GmbH Purchase Order.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2128 set thread context of 3456 2128 KIEFEL Packaging GmbH Purchase Order.exe 86 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe 3456 KIEFEL Packaging GmbH Purchase Order.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2128 KIEFEL Packaging GmbH Purchase Order.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3456 KIEFEL Packaging GmbH Purchase Order.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3456 2128 KIEFEL Packaging GmbH Purchase Order.exe 86 PID 2128 wrote to memory of 3456 2128 KIEFEL Packaging GmbH Purchase Order.exe 86 PID 2128 wrote to memory of 3456 2128 KIEFEL Packaging GmbH Purchase Order.exe 86 PID 2128 wrote to memory of 3456 2128 KIEFEL Packaging GmbH Purchase Order.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nspBB67.tmp\plxisbbfs.dll
- Size 22KB
- SHA256 fac43f4994e9fb106a14d0d7ad9570f213aab91bb24b7b2d7b3295cbd78e97d7
- MD5 64b537208d1fe421e15bd92454e4250d
- SHA1 9c396d9804dacf3d3f3c5992e1bfa7cad367d217
- SHA512 710c8aeb11ea577be8d7fec07465e43d8d8f3de64c8de14fdeb15db35f5cd708facea193b620b33e49b28cf5d8fd9b3daad1336a29ef5809b8de5b17504211cb
- SSDEEP 192:eALkIAXmcxPhQc+Q8t4+gaECeZJaJewLRsutxFBXgGW8fEvMCALnN7kNt/E/ghWV:7GlmEWsuPXjW8fPNQfEfoDCCtZBMwN7
- MD5 SHA1 SHA512 SSDEEP