5cf8e944ea54195e221343dec2bb3728c5faecc2b55be781b597503a7ae2fd39

Analysis

max time kernel
106s
max time network
66s
platform
windows10_x64
resource
win10v20201028
submitted
06/01/2021, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan003.pdf.exe
Size 865KB
Sample210106-e66kwh4dws
SHA256 5cf8e944ea54195e221343dec2bb3728c5faecc2b55be781b597503a7ae2fd39
MD5 2a479d08a46cfa1ff0e0a379ee4fc79d
SHA1 8c9a8ddbcc0259f94d0ec0ea91f9211ba8a62fc5
SHA512 dac274192754eb2d98d15be7535eb32a96f321fc5ff94b4694751395c4d18c6406f876519f7560dbdd02112bc730a0108b3a21c18c38ca601b96806ab74bd8f2
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 2040	640	Scan003.pdf.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	Scan003.pdf.exe
2040	Scan003.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	Scan003.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78
PID 640 wrote to memory of 2040	640	Scan003.pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\Scan003.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Scan003.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\Scan003.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan003.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-9-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/640-11-0x0000000005C60000-0x0000000005CCB000-memory.dmp

Download

memory/640-6-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/640-7-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/640-8-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/640-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/640-10-0x0000000004F90000-0x0000000004FA7000-memory.dmp

Download

memory/640-5-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/640-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/2040-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2040-15-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/2040-20-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/2040-21-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download