Analysis
- max time kernel
81s - max time network
124s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
15/10/2021, 09:25
General
- Target 采购订单 _6376627627737_______________.pdf.exe
- Size 498KB
- Sample211015-ldl9ssbecj
- SHA256 7bd68279cf4cc59ba39b3d6709bae5312c55b880562ad88b606516d415b2b8a4
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\采购订单 _6376627627737_______________.pdf.exe"C:\Users\Admin\AppData\Local\Temp\采购订单 _6376627627737_______________.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 11442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3472-115-0x0000000000520000-0x0000000000521000-memory.dmp
memory/3472-117-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/3472-118-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
memory/3472-119-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/3472-120-0x0000000004EC0000-0x0000000004EC5000-memory.dmp
memory/3472-121-0x0000000004EE0000-0x00000000053DE000-memory.dmp
memory/3472-122-0x0000000005BE0000-0x0000000005BE1000-memory.dmp
memory/3472-123-0x0000000005380000-0x00000000053D8000-memory.dmp