Analysis
-
max time kernel
40s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 08:27
Static task
static1
Behavioral task
behavioral1
Sample
Mv Maersk Kleven V949E_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
Mv Maersk Kleven V949E_pdf.exe
-
Size
1.1MB
-
MD5
c51426e6158e25efab0b9859ce297334
-
SHA1
6cd654c66b18f5434bff4ba86b4dfe075501226b
-
SHA256
4db5b653da7215e99856218e03e259546f95cf4bc5680395077e3f2b96754750
-
SHA512
d9fe4cae494edd6dbe9d890dab4352ad34c426e74a4afc8276d39ea85a05684565d8c9a8eb8a8812a015758499946c9481c4e6c49fd05b45c447998b33cbff9d
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Mv Maersk Kleven V949E_pdf.exepid process 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe 2028 Mv Maersk Kleven V949E_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Mv Maersk Kleven V949E_pdf.exedescription pid process Token: SeDebugPrivilege 2028 Mv Maersk Kleven V949E_pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Mv Maersk Kleven V949E_pdf.exedescription pid process target process PID 2028 wrote to memory of 2024 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2024 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2024 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2024 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2004 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2004 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2004 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 2004 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 1992 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 1992 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 1992 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 1992 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 476 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 476 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 476 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 476 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 436 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 436 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 436 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe PID 2028 wrote to memory of 436 2028 Mv Maersk Kleven V949E_pdf.exe Mv Maersk Kleven V949E_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Mv Maersk Kleven V949E_pdf.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/2028-3-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2028-5-0x0000000004C50000-0x0000000004D40000-memory.dmpFilesize
960KB
-
memory/2028-6-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/2028-7-0x0000000000630000-0x000000000063E000-memory.dmpFilesize
56KB
-
memory/2028-8-0x00000000064A0000-0x0000000006529000-memory.dmpFilesize
548KB