5f474b40c8bd056549cbf8b574f80bf8198d53f29bdb3ee5eb21db0700b71f7c | Triage™

Analysis

max time kernel
110s
max time network
121s
platform
windows10_x64
resource
win10-en-20210920
submitted
26/10/2021, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order of CB-15GL PO530_pdf.exe
Size 383KB
Sample211026-pse1tahde6
SHA256 5f474b40c8bd056549cbf8b574f80bf8198d53f29bdb3ee5eb21db0700b71f7c
MD5 353b88ef182a879a18111d827df5f10c
SHA1 bd9ca55653edda3cd9948b36598271fb89ac5f72
SHA512 8978d138f172d8c7d4ec1946620afd0844cd6cec2120f2e8ee4608a66ee2e84eb0d60da0dd552f4eb7cc5a521f3fc1a3f7585622cd825dd83cb668fe0b8a3581
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	dw20.exe
1016	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1016	dw20.exe
Token: SeBackupPrivilege	1016	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1016	3256	Order of CB-15GL PO530_pdf.exe	70
PID 3256 wrote to memory of 1016	3256	Order of CB-15GL PO530_pdf.exe	70
PID 3256 wrote to memory of 1016	3256	Order of CB-15GL PO530_pdf.exe	70

C:\Users\Admin\AppData\Local\Temp\Order of CB-15GL PO530_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order of CB-15GL PO530_pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 932
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3256-118-0x0000000002B60000-0x0000000002B61000-memory.dmp

Download