aab4d0198e57e6a91a1318310347b8a9d16d7fee076211fcb9dcb5a720a2fc71

Analysis

max time kernel
19s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
22/02/2021, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Case Activated CCMA Case GAJB00138471-21.pdf.exe
Size 857KB
Sample210222-bl583fewg6
SHA256 aab4d0198e57e6a91a1318310347b8a9d16d7fee076211fcb9dcb5a720a2fc71
MD5 4e729521bcdb0e1a8f3d0699e3b82b12
SHA1 79d95630d6685ebe59bf855be8e40f9dba25e0ff
SHA512 30f46c99ce7c3043f7e9068781f4098c81527c37f22bffc90c9a2248448d5ec00a00033f06d0833ec84dd7c7e12764ffd13606c4c7f9ebba1e2a2efc1fdc1364
MD5 SHA1 SHA512

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3928-11-0x00000000070F0000-0x0000000007111000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	1456	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe
3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe
Token: SeRestorePrivilege	4000	WerFault.exe
Token: SeBackupPrivilege	4000	WerFault.exe
Token: SeDebugPrivilege	4000	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78
PID 3928 wrote to memory of 1456	3928	New Case Activated CCMA Case GAJB00138471-21.pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\New Case Activated CCMA Case GAJB00138471-21.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New Case Activated CCMA Case GAJB00138471-21.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\New Case Activated CCMA Case GAJB00138471-21.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Case Activated CCMA Case GAJB00138471-21.pdf.exe"
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 324
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-19-0x00000000005A0000-0x00000000005C0000-memory.dmp

Download

memory/3928-12-0x0000000007460000-0x0000000007461000-memory.dmp

Download

memory/3928-13-0x0000000007420000-0x0000000007421000-memory.dmp

Download

memory/3928-7-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/3928-8-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/3928-9-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/3928-11-0x00000000070F0000-0x0000000007111000-memory.dmp

Download

memory/3928-2-0x0000000073BA0000-0x000000007428E000-memory.dmp

Download

memory/3928-6-0x00000000049B0000-0x00000000049B1000-memory.dmp

Download

memory/3928-14-0x0000000004FD1000-0x0000000004FD2000-memory.dmp

Download

memory/3928-15-0x0000000007370000-0x000000000737B000-memory.dmp

Download

memory/3928-16-0x00000000060E0000-0x00000000060E1000-memory.dmp

Download

memory/3928-5-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/3928-3-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/4000-20-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download