f44a7323fa21d5b6ab9ee259aa3c764442087425652c3f32c798b5af8a5c54ad

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KIEFEL Packaging GmbH Purchase Order.exe
Size

254KB
MD5

850dab1779d10d934754d3b5a49367e7
SHA1

7b82f354de7fa54e6c15eeb9ade13d81ca501df3
SHA256

f44a7323fa21d5b6ab9ee259aa3c764442087425652c3f32c798b5af8a5c54ad
SHA512

ada74c7650db6c536477c275f9d4a604ff0f52c0d136469a46d26d4b890b5f51627f64218588c08405233627567e66ac033d2a5d52d0728d4d642c6af4e3513c
SSDEEP

6144:/Ya6YGirsR+LQIFjVqoWu8pAs/hGSPuhaymQp+csaRf8rYikjhYyND7Enu:/YuGiISjVFvvsASGhayz+TqKQvEnu

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Control Panel\International\Geo\Nation	KIEFEL Packaging GmbH Purchase Order.exe

Loads dropped DLL 1 IoCs

pid	Process
1432	KIEFEL Packaging GmbH Purchase Order.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe
876	KIEFEL Packaging GmbH Purchase Order.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1432	KIEFEL Packaging GmbH Purchase Order.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	KIEFEL Packaging GmbH Purchase Order.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28
PID 1432 wrote to memory of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28
PID 1432 wrote to memory of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28
PID 1432 wrote to memory of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28
PID 1432 wrote to memory of 876	1432	KIEFEL Packaging GmbH Purchase Order.exe	28

C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\KIEFEL Packaging GmbH Purchase Order.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd409.tmp\xveqlpk.dll

Filesize
6KB

MD5
88c1639d18939c8dc1e58b725df777f7

SHA1
01f4c85dcec51c3b3139e81689a7db0692c7182b

SHA256
74e7c6038c19ab9bf5c76e1b7e3383cdba6b994163199fdd5b097f70213f08fa

SHA512
b72f5a259100f359602f34dd8a17ded0e0f5dd47f6bfe7c237d6e56386b3a814e9138d1e5df646a11677af9c254c9015f700ea1876a82172103f83daf618873b

Download Submit
memory/876-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/876-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/876-63-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/876-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download