Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:55
Static task
static1
Behavioral task
behavioral1
Sample
009865.PDF.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
009865.PDF.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
009865.PDF.exe
-
Size
779KB
-
MD5
ae683582bc9e495df07b906e3b94873b
-
SHA1
03105c593dfe693398fbfd27e788bf4ce840977f
-
SHA256
06877846c6e43d02cb0ff3899b0a7cb450c09285c66fe7e63a08d00f4b3580bb
-
SHA512
8d761ff051be1614f9f2fb052cdc5094e2c625f9b694b8451110b4cc6d10bd1bdf4e82c770779d7915a8f3573cb3cbf42fb6b8de56595c6b35f03457873edcc0
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
009865.PDF.exepid process 760 009865.PDF.exe 760 009865.PDF.exe 760 009865.PDF.exe 760 009865.PDF.exe 760 009865.PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
009865.PDF.exedescription pid process Token: SeDebugPrivilege 760 009865.PDF.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
009865.PDF.exedescription pid process target process PID 760 wrote to memory of 1504 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1504 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1504 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1504 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2008 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2008 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2008 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2008 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2000 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2000 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2000 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 2000 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1488 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1488 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1488 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1488 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1172 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1172 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1172 760 009865.PDF.exe 009865.PDF.exe PID 760 wrote to memory of 1172 760 009865.PDF.exe 009865.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\009865.PDF.exe"{path}"2⤵