Analysis
-
max time kernel
9s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 06:26
Static task
static1
Behavioral task
behavioral1
Sample
Groupo Dani Order_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Groupo Dani Order_pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Groupo Dani Order_pdf.exe
-
Size
215KB
-
MD5
715dfb732da37b8c39d84c2659d2824d
-
SHA1
cdd082fb4ef27cc88a48142926b28cf0b11c9c24
-
SHA256
d8342bc5be6d94ead3b75ef8f1ecfcf93ca0c001c77c7832edd6c79169f2cf88
-
SHA512
3459d03a277302d8189c422ffabe827951cdea3b12fcf7736428703c66f5c794def1ae367185c24998669af419b13870c48909f92f4539c400fbcea50f01aae5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Groupo Dani Order_pdf.exepid process 644 Groupo Dani Order_pdf.exe 644 Groupo Dani Order_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Groupo Dani Order_pdf.exedescription pid process Token: SeDebugPrivilege 644 Groupo Dani Order_pdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Groupo Dani Order_pdf.exedescription pid process target process PID 644 wrote to memory of 1340 644 Groupo Dani Order_pdf.exe dw20.exe PID 644 wrote to memory of 1340 644 Groupo Dani Order_pdf.exe dw20.exe PID 644 wrote to memory of 1340 644 Groupo Dani Order_pdf.exe dw20.exe PID 644 wrote to memory of 1340 644 Groupo Dani Order_pdf.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Groupo Dani Order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Groupo Dani Order_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5162⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-2-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/644-3-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/1340-4-0x0000000000000000-mapping.dmp
-
memory/1340-5-0x0000000001EC0000-0x0000000001ED1000-memory.dmpFilesize
68KB
-
memory/1340-7-0x0000000001E30000-0x0000000001E31000-memory.dmpFilesize
4KB