Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 09:26

General

  • Target

    New order 983765_2021,pdf.exe

  • Size

    300KB

  • MD5

    a3bc7e4679d068b07b086e170aa00de9

  • SHA1

    8586c3c5d2d0d7a62a93df786efb82d49e3639e6

  • SHA256

    9c926fe5371a4b6fea65e5db63e339c6d2e5d81b52f2e8c4522869d7bc41517b

  • SHA512

    5b52ffcc4825fbe0dcb065de1817921173c8ae158c66df89b7aa907b3f544dc2a74124475a33d1df153ce11d77a1d39b9b3850d9bc6ed48e6425d2f78b9d7b2a

  • SSDEEP

    6144:F8LxBdMtMdWuiT10Unn60bYM7JAwOQ9fQe9GsXWEz683JLLwaEzdcNSnEA+:xMd0dVbYBQfGsGEz685LLwjzmNcM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New order 983765_2021,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\New order 983765_2021,pdf.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Users\Admin\AppData\Local\Temp\New order 983765_2021,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\New order 983765_2021,pdf.exe"
      2⤵
        PID:220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1020
        2⤵
        • Program crash
        PID:1064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3088 -ip 3088
      1⤵
        PID:2524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsdA902.tmp\edfkc.dll

        Filesize

        106KB

        MD5

        5764627a81a77a4197a8e8383e943011

        SHA1

        16e3f84d8e1b2dacd3b85c85ba1f5bde41a961fa

        SHA256

        856422a4568c141501f6b6eafbbbdd189c64e39c585536a5272b04a9fbc64941

        SHA512

        7cca6ab879bb8e39dd8819435631d479131152b906b7628c570d7dc1d4adb11e09f1fbf8b283e0798befcfef874021d8faa5d66d766ae3d08593868b981bdcb2

      • memory/3088-4-0x0000000010000000-0x0000000010020000-memory.dmp

        Filesize

        128KB

      • memory/3088-9-0x0000000010000000-0x0000000010020000-memory.dmp

        Filesize

        128KB