Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-04-2021 10:13
Static task
static1
Behavioral task
behavioral1
Sample
QFSN0331PDF.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
QFSN0331PDF.exe
-
Size
519KB
-
MD5
18377afa571a27e3d67024934eb425fc
-
SHA1
72e4b926dcf352558304f42fac331b2dda61049e
-
SHA256
edbc5c4578e139f3194afcb1ccd8627f8f966bfda05e4574d0e8dcc65b8a4dcb
-
SHA512
7ea97d9f6bfe31288d8487386ec5d92ea9d9d7832813d40f20c49cc345c03b4caec4c2558258c7f5d895663a38aff1afe8edd70bf49ebed4dfbcb5b8a0542475
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
QFSN0331PDF.exedescription pid process target process PID 1812 set thread context of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
QFSN0331PDF.exepid process 1812 QFSN0331PDF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QFSN0331PDF.exeQFSN0331PDF.exedescription pid process Token: SeDebugPrivilege 1812 QFSN0331PDF.exe Token: SeDebugPrivilege 240 QFSN0331PDF.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
QFSN0331PDF.exedescription pid process target process PID 1812 wrote to memory of 740 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 740 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 740 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 740 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe PID 1812 wrote to memory of 240 1812 QFSN0331PDF.exe QFSN0331PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-8-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/240-9-0x00000000004296EE-mapping.dmp
-
memory/240-10-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/240-11-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/240-13-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/1812-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1812-3-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1812-5-0x0000000000270000-0x0000000000279000-memory.dmpFilesize
36KB
-
memory/1812-6-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/1812-7-0x0000000004F20000-0x0000000004F78000-memory.dmpFilesize
352KB