Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
01-12-2021 17:28
Static task
static1
Behavioral task
behavioral1
Sample
DHL Delivery Documents.pdf.exe
Resource
win7-en-20211104
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Delivery Documents.pdf.exe
Resource
win10-en-20211104
0 signatures
0 seconds
General
-
Target
DHL Delivery Documents.pdf.exe
-
Size
619KB
-
MD5
b25de32c3e31abcfb2b051d2d753e79b
-
SHA1
b0675fa9794f8bc58183e23f368f04c9fb8f1da5
-
SHA256
b77b44a682f3bbfeb6bdfeb66fd97bd0796f5fae706661350d767ab585c9d49f
-
SHA512
7f8c61d1170067737a240ac069b386cac64fff86762a866d96ed4820618bedb847e5819bce839deeb750acdb21f9b38546d8c8bc167af48ba4a536aab01c0d65
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1864 1612 WerFault.exe DHL Delivery Documents.pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1864 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1864 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription pid process target process PID 1612 wrote to memory of 1864 1612 DHL Delivery Documents.pdf.exe WerFault.exe PID 1612 wrote to memory of 1864 1612 DHL Delivery Documents.pdf.exe WerFault.exe PID 1612 wrote to memory of 1864 1612 DHL Delivery Documents.pdf.exe WerFault.exe PID 1612 wrote to memory of 1864 1612 DHL Delivery Documents.pdf.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 6802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-55-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1612-57-0x0000000075491000-0x0000000075493000-memory.dmpFilesize
8KB
-
memory/1612-58-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/1612-59-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/1612-60-0x0000000005DC0000-0x0000000005E50000-memory.dmpFilesize
576KB
-
memory/1864-61-0x0000000000000000-mapping.dmp
-
memory/1864-62-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB