Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05-02-2024 19:45

General

  • Target

    ORDER#4510093083_POs_NEW_MATERIAL_JAN_2024_POs_pdfs.exe

  • Size

    789KB

  • MD5

    e2889893d75c1ea7bd8982274873b1b8

  • SHA1

    9ebedbf8146b9862503bf3c40239e169b09c67a7

  • SHA256

    5a30a9b801943074fc132f20ab5f77cc2c2bd95ccd76a535b3ad7e8fcf6d1cdd

  • SHA512

    a5c2fa4c73b885dd51cb07a227eb709805ec2d50c20be4f97f363f27dc2dd5377d4da9f695cd075287c50a619823082624a5f01838ae6dc126d4c51a70eb1275

  • SSDEEP

    24576:hMwhWpdsQpT6q3tmxUgxDEuZ9WI+spi9iCnqV+:hMweskT6q30x4uZ8dr9q4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_POs_NEW_MATERIAL_JAN_2024_POs_pdfs.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_POs_NEW_MATERIAL_JAN_2024_POs_pdfs.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:1900

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Fonts\snlig.ini
    Filesize

    43B

    MD5

    75285908e15263897f2fe77cc637ef6e

    SHA1

    cc5a707cae259834b2453a305af9453b7b7412ac

    SHA256

    6fc175d4186cfb67d46e22b277602aa3ec665ad44c9854e7bdaf0e5a25cefbc5

    SHA512

    e93afaa0772d9aa9a8d77e44473a5c58cf9f3b214b76d5ed94e08dbc2ae9ef3d67b470073b83c157318bfa67fb44e17833af313efe8ded28e07d55272eb4edb2

  • \Users\Admin\AppData\Local\Temp\nsdB86.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472