Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:34
Static task
static1
Behavioral task
behavioral1
Sample
28273_pdf.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
28273_pdf.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
28273_pdf.exe
-
Size
518KB
-
MD5
e771e9ad3b315af96417f8afb43277d1
-
SHA1
191e14a19791415e893a48d5877ac1c9374c3895
-
SHA256
9b7f18795309cd9c9caafad0151d83817f72f1e1caf506b4173d62a988a5e2ec
-
SHA512
2dff31bfe24297fc27b95948baa00f07e3c59973418294c57bd496b1e15248c623347357dc2b0fc61ce3e389d9f0cd1d2a16042c374bc41301503f33c9865282
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
28273_pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiotl = "\"C:\\Users\\Admin\\AppData\\Local\\audiotl.exe\"" 28273_pdf.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
28273_pdf.exepid process 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe 4900 28273_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
28273_pdf.exedescription pid process Token: SeDebugPrivilege 4900 28273_pdf.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4900-130-0x0000000000CF0000-0x0000000000D76000-memory.dmpFilesize
536KB
-
memory/4900-131-0x0000000005D00000-0x00000000062A4000-memory.dmpFilesize
5.6MB
-
memory/4900-132-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/4900-133-0x00000000058F0000-0x00000000058FA000-memory.dmpFilesize
40KB
-
memory/4900-134-0x0000000005A70000-0x0000000005B0C000-memory.dmpFilesize
624KB
-
memory/4900-135-0x00000000065B0000-0x0000000006616000-memory.dmpFilesize
408KB