cc5b6de547c05bde0f4ebd87736dc83e5bb28d3641e15a3e9e665dc6075bf593

General

Target
RFQ-42956H.PDF.exe
Size 1.0MB
Sample200624-pg2nr7cb3a
SHA256 cc5b6de547c05bde0f4ebd87736dc83e5bb28d3641e15a3e9e665dc6075bf593
MD5 a4b5e74408bc35da869b69d739b22585
SHA1 a9be1594d3daf8739df42cdecc44864ccd368444
SHA512 1ce26f90a614d45d4a3efb0c5e519b626b7c6bafe6b4cbe1354edd7ad35d85b45dbc38c6facdbff21bd905b00ca621ce02cb2fb636023b1ceeb2900ced4d9b40
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1876	1460	RFQ-42956H.PDF.exe	26
PID 1460 wrote to memory of 1876	1460	RFQ-42956H.PDF.exe	26
PID 1460 wrote to memory of 1876	1460	RFQ-42956H.PDF.exe	26
PID 1460 wrote to memory of 1876	1460	RFQ-42956H.PDF.exe	26
PID 1460 wrote to memory of 1824	1460	RFQ-42956H.PDF.exe	28
PID 1460 wrote to memory of 1824	1460	RFQ-42956H.PDF.exe	28
PID 1460 wrote to memory of 1824	1460	RFQ-42956H.PDF.exe	28
PID 1460 wrote to memory of 1824	1460	RFQ-42956H.PDF.exe	28
PID 1460 wrote to memory of 1836	1460	RFQ-42956H.PDF.exe	29
PID 1460 wrote to memory of 1836	1460	RFQ-42956H.PDF.exe	29
PID 1460 wrote to memory of 1836	1460	RFQ-42956H.PDF.exe	29
PID 1460 wrote to memory of 1836	1460	RFQ-42956H.PDF.exe	29
PID 1460 wrote to memory of 1832	1460	RFQ-42956H.PDF.exe	30
PID 1460 wrote to memory of 1832	1460	RFQ-42956H.PDF.exe	30
PID 1460 wrote to memory of 1832	1460	RFQ-42956H.PDF.exe	30
PID 1460 wrote to memory of 1832	1460	RFQ-42956H.PDF.exe	30
PID 1460 wrote to memory of 1752	1460	RFQ-42956H.PDF.exe	31
PID 1460 wrote to memory of 1752	1460	RFQ-42956H.PDF.exe	31
PID 1460 wrote to memory of 1752	1460	RFQ-42956H.PDF.exe	31
PID 1460 wrote to memory of 1752	1460	RFQ-42956H.PDF.exe	31
PID 1460 wrote to memory of 1676	1460	RFQ-42956H.PDF.exe	32
PID 1460 wrote to memory of 1676	1460	RFQ-42956H.PDF.exe	32
PID 1460 wrote to memory of 1676	1460	RFQ-42956H.PDF.exe	32
PID 1460 wrote to memory of 1676	1460	RFQ-42956H.PDF.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	RFQ-42956H.PDF.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1876	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1460
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VmuzXYksZAF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp336E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1876
- C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
  "{path}"
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
  "{path}"
  2⤵
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
  "{path}"
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
  "{path}"
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\RFQ-42956H.PDF.exe
  "{path}"
  2⤵
  PID:1676