Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 13:07
Static task
static1
Behavioral task
behavioral1
Sample
New Order.pdf.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Order.pdf.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
New Order.pdf.exe
-
Size
306KB
-
MD5
33734974cdccb671d66899e0cca55d84
-
SHA1
e8cefa5364738a13c537b5b4efb0f6d00e207991
-
SHA256
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f
-
SHA512
c392843a80a73693a166bef590a15b1a6c3cfc51f46e767a941ea74bedc177ca223c40196a661e4c7dd3fd85f8047c6ea3d07d2919f9798f0b1c04066410f069
Score
3/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New Order.pdf.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3944 New Order.pdf.exe Token: SeRestorePrivilege 3992 WerFault.exe Token: SeBackupPrivilege 3992 WerFault.exe Token: SeDebugPrivilege 3992 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
New Order.pdf.exeWerFault.exepid process 3944 New Order.pdf.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe 3992 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3992 3944 WerFault.exe New Order.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 9642⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash