f69821010916c746e5e371fcd011dda072fdfc09ac964e9db9506a97cec1fe3e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inv300123.pdf.exe
Size

249KB
MD5

c1d715af9940a5e70e1ab58fecc18dba
SHA1

a223f8c86b1748e3f7bccccd13c864507505e09c
SHA256

3b49db8324bc576c3d9e31d4bd1c27af48f3ec36652b95991a3b4803c6a48ad8
SHA512

99fef3200ab3cf200a4d23ed95edbbc7005b856b599a2b832bedf9cb16ffc62dc6f5bc6c073a95e3f473b055621e4e022801c72ff4c0ab818253fdba59cafd53
SSDEEP

6144:wBlL/c/QkZXt5dYUpKdCASZEJsfgnv1KhsiGcO3:CezZJ7pDhZEJggnNceH3

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2196	inv300123.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2196	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inv300123.pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4688	2196	inv300123.pdf.exe	83
PID 2196 wrote to memory of 4688	2196	inv300123.pdf.exe	83
PID 2196 wrote to memory of 4688	2196	inv300123.pdf.exe	83

C:\Users\Admin\AppData\Local\Temp\inv300123.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\inv300123.pdf.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\inv300123.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\inv300123.pdf.exe"
  2⤵
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1040
  2⤵
  - Program crash
  PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2196 -ip 2196
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc597B.tmp\nqdipsrotb.dll

Filesize
31KB

MD5
8ab953e111816f48fd4aab119809af53

SHA1
5ad3c9b13395ea5912bbff13746171a387f43979

SHA256
cb989078f012a4f8f8fe2b0ee20790a792dc6f1968cb0bba55f654ffb3346c20

SHA512
75b37e5fcc1994686eb91316ef45ec46e9ada54cbe985e9671c8e0d09a153ddb6bbfd2881dc278c6b351c6a022d1db6c33b6b7a7ce73b0eb4af5a84ca2e7e421

Download Submit
memory/2196-4-0x0000000075200000-0x000000007520B000-memory.dmp

Filesize
44KB

Download
memory/2196-9-0x0000000075200000-0x000000007520B000-memory.dmp

Filesize
44KB

Download