Overview

overview

10

Static

static

New PO.pdf.'.exe

windows7_x64

1

New PO.pdf.'.exe

windows10_x64

10

Analysis

  • max time kernel
    40s
  • max time network
    14s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19-04-2021 14:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New PO.pdf.'.exe

  • Size

    829KB

  • MD5

    ea2f6afd43fe464c3b90f05762def390

  • SHA1

    cf20ecb582c6c6385860bc7a76a866a3f28c06aa

  • SHA256

    587de2149d6418990852b59fdb044911f6dd33f60bc6392fb2e93c8538b91453

  • SHA512

    409241a1f4e7f284055751881534a932eb23d27edd0779ee78b90b9cc666925a927a3851a37feca63773b1c72f0b1945e9dfc7259b9931066e4de8f1ecdccc60

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
    "C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
      "{path}"
      2⤵
        PID:1776
      • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
        "{path}"
        2⤵
          PID:472
        • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
          "{path}"
          2⤵
            PID:316
          • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
            "{path}"
            2⤵
              PID:1772
            • C:\Users\Admin\AppData\Local\Temp\New PO.pdf.'.exe
              "{path}"
              2⤵
                PID:320

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1116-60-0x0000000000020000-0x0000000000021000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1116-62-0x0000000001F50000-0x0000000001FC6000-memory.dmp
              Filesize

              472KB

              Download
            • memory/1116-63-0x0000000004A90000-0x0000000004A91000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1116-64-0x0000000000480000-0x0000000000485000-memory.dmp
              Filesize

              20KB

              Download
            • memory/1116-65-0x0000000005380000-0x0000000005417000-memory.dmp
              Filesize

              604KB

              Download
            • memory/1116-66-0x0000000004DE0000-0x0000000004E37000-memory.dmp
              Filesize

              348KB

              Download