76d60cec5d6006b89ad22fb2cfbfe6d50962092bfbca1507ed1e3f886ad63edd

General

Target
scan_00528PO1.pdf.exe
Size 930KB
Sample200722-q7pcq85r7a
SHA256 76d60cec5d6006b89ad22fb2cfbfe6d50962092bfbca1507ed1e3f886ad63edd
MD5 2e8ff17f2899ac647317f3a1c6a43b39
SHA1 66f94a30efd7af4218ea99db7ec6e324c1a13790
SHA512 36ed4f90689e3e5d42dabd324f99137e565b4d31691de54bb0ddea13e22bad860555253a6bb807c35c6e7616765eb59e902f0342bccaf52007c9420c23835aa7
MD5 SHA1 SHA512

Score

7^/10

spyware

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2800	schtasks.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2800	2116	scan_00528PO1.pdf.exe	68
PID 2116 wrote to memory of 2800	2116	scan_00528PO1.pdf.exe	68
PID 2116 wrote to memory of 2800	2116	scan_00528PO1.pdf.exe	68
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70
PID 2116 wrote to memory of 3532	2116	scan_00528PO1.pdf.exe	70

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 3532	2116	scan_00528PO1.pdf.exe	70

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	scan_00528PO1.pdf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	scan_00528PO1.pdf.exe
3532	scan_00528PO1.pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	scan_00528PO1.pdf.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\scan_00528PO1.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\scan_00528PO1.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2116
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zUBZBokuOG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\scan_00528PO1.pdf.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3532