Analysis
- max time kernel
135s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
15/10/2021, 09:25
General
- Target 采购订单 _6376627627737_______________.pdf.exe
- Size 498KB
- Sample211015-ldl9ssbecj
- SHA256 7bd68279cf4cc59ba39b3d6709bae5312c55b880562ad88b606516d415b2b8a4
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\采购订单 _6376627627737_______________.pdf.exe"C:\Users\Admin\AppData\Local\Temp\采购订单 _6376627627737_______________.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 6722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-61-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/1700-54-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/1700-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
memory/1700-57-0x00000000003F0000-0x00000000003F5000-memory.dmp
memory/1700-58-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1700-59-0x0000000005020000-0x0000000005078000-memory.dmp