Analysis
- max time kernel
121s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
10/12/2021, 06:32
General
- Target VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe
- Size 1.1MB
- Sample211210-hal8vaghhm
- SHA256 549d64bd9bc60269b7536f13659e902bc284f3fe586e5fe2d6e9720be7643505
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe"C:\Users\Admin\AppData\Local\Temp\VERGİ ÖDEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 12242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2376-115-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/2376-117-0x0000000005E20000-0x0000000005E21000-memory.dmp
memory/2376-118-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/2376-119-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
memory/2376-120-0x0000000005C80000-0x0000000005C87000-memory.dmp
memory/2376-121-0x0000000005920000-0x0000000005E1E000-memory.dmp
memory/2376-122-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/2376-123-0x0000000009010000-0x0000000009011000-memory.dmp
memory/2376-124-0x00000000090B0000-0x00000000091C6000-memory.dmp