1d3a4b188ed5f70862cf8dc67c9ccb1cae2b2f94ee847c3e1504ac13721eadd1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10/08/2023, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
報價請求 (NTU 202308-10TW)·pdf.exe
Size 985KB
Sample230810-g4ynascc8x
SHA256 1d3a4b188ed5f70862cf8dc67c9ccb1cae2b2f94ee847c3e1504ac13721eadd1
MD5 4267367fe2f39a1b7f2af8b01bdc9a09
SHA1 a0157d55e861e23b41353a7093dbde6a2c8ed885
SHA512 4d65b94e2c5852154c980e6cec4e2475476cd34ab55c9fc9e2ffe3c9d957279ecdcba8f7e6d863348b87761eb16f01561ea485e26b87c2ef4bbb996e83792694
SSDEEP 24576:IFiS4QH1OeoVhlbP0HEjiCs0IcdNaI+TpZcOe26:/SpweiP5eTyNdypuOy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2224	報價請求 (NTU 202308-10TW)·pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2600	2224	報價請求 (NTU 202308-10TW)·pdf.exe	28
PID 2224 wrote to memory of 2600	2224	報價請求 (NTU 202308-10TW)·pdf.exe	28
PID 2224 wrote to memory of 2600	2224	報價請求 (NTU 202308-10TW)·pdf.exe	28
PID 2224 wrote to memory of 2600	2224	報價請求 (NTU 202308-10TW)·pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\報價請求 (NTU 202308-10TW)·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\報價請求 (NTU 202308-10TW)·pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 488
  2⤵
  - Program crash
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nso872B.tmp\System.dll
Size 11KB
SHA256 f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b
MD5 b853d5d2361ade731e33e882707efc34
SHA1 c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be
SHA512 8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69
SSDEEP 192:eA2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsEf:mS62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2224-64-0x00000000034E0000-0x0000000006228000-memory.dmp

Download

memory/2224-65-0x00000000034E0000-0x0000000006228000-memory.dmp