Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
10/12/2021, 06:32
General
- Target VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe
- Size 1.1MB
- Sample211210-hal8vaghhm
- SHA256 549d64bd9bc60269b7536f13659e902bc284f3fe586e5fe2d6e9720be7643505
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe"C:\Users\Admin\AppData\Local\Temp\VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 7122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-61-0x0000000001E00000-0x0000000001E01000-memory.dmp
memory/904-54-0x00000000010D0000-0x00000000010D1000-memory.dmp
memory/904-56-0x00000000762C1000-0x00000000762C3000-memory.dmp
memory/904-57-0x0000000005010000-0x0000000005011000-memory.dmp
memory/904-58-0x0000000000450000-0x0000000000457000-memory.dmp
memory/904-59-0x0000000006010000-0x0000000006126000-memory.dmp