Analysis
- max time kernel
64s - max time network
45s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
22/09/2021, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
Updated SOA 210920.PDF.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target Updated SOA 210920.PDF.exe
- Size 505KB
- Sample210922-pexnpsfbcj
- SHA256 81d263a31fc8b6fe2e2db250efd4314912eb09a11027a6cfc67257d7fa5e071a
- MD5 66474aafcf1b5dae6da44f0965ee5e29
- SHA1 d6bbe45bccd177c75648ddf45db11f0e6ee808e5
- SHA512 11d6082595a50c7dc2ada61255e4022dfb326e00021c8ed1c7b55330b8d373e11493f69209db2be00d06ab4ada76ae875697fc468361e437e1ec474ea71e3eda
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1428 Updated SOA 210920.PDF.exe 1428 Updated SOA 210920.PDF.exe 1428 Updated SOA 210920.PDF.exe 1428 Updated SOA 210920.PDF.exe 1428 Updated SOA 210920.PDF.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1428 Updated SOA 210920.PDF.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 484 1428 Updated SOA 210920.PDF.exe 27 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 752 1428 Updated SOA 210920.PDF.exe 28 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 972 1428 Updated SOA 210920.PDF.exe 29 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1700 1428 Updated SOA 210920.PDF.exe 30 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31 PID 1428 wrote to memory of 1656 1428 Updated SOA 210920.PDF.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵PID:484
-
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵PID:752
-
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵PID:1656
-