Analysis
-
max time kernel
88s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 08:19
Static task
static1
Behavioral task
behavioral1
Sample
WSI20220629_ContractWSI142121Copy001_pdf.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
WSI20220629_ContractWSI142121Copy001_pdf.exe
-
Size
523KB
-
MD5
f44df8e521612af374436c38e064d7cb
-
SHA1
cc3fbff8f4fde3b36b52a9884861742630581fa9
-
SHA256
ca5902ad221da0095483c07a92712b8d6cd9e7c5733b99dd9d7e8ce4e40bef16
-
SHA512
3d2c17896fb66cfc1d2ef55ab1607b7deb43a29103abb6fdd218f9617634e3159257906d92dfb6bf3078580632a1e09bcb7dc71599ef64151bad4320de76b9d8
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WSI20220629_ContractWSI142121Copy001_pdf.exepid process 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WSI20220629_ContractWSI142121Copy001_pdf.exedescription pid process Token: SeDebugPrivilege 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
WSI20220629_ContractWSI142121Copy001_pdf.exedescription pid process target process PID 1076 wrote to memory of 1936 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1936 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1936 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1936 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1348 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1348 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1348 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1348 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1212 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1212 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1212 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1212 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1136 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1136 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1136 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1136 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1164 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1164 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1164 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe PID 1076 wrote to memory of 1164 1076 WSI20220629_ContractWSI142121Copy001_pdf.exe WSI20220629_ContractWSI142121Copy001_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"C:\Users\Admin\AppData\Local\Temp\WSI20220629_ContractWSI142121Copy001_pdf.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-54-0x0000000000380000-0x000000000040A000-memory.dmpFilesize
552KB
-
memory/1076-55-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1076-56-0x00000000004B0000-0x00000000004CE000-memory.dmpFilesize
120KB
-
memory/1076-57-0x00000000004D0000-0x00000000004DE000-memory.dmpFilesize
56KB
-
memory/1076-58-0x0000000005D70000-0x0000000005DD6000-memory.dmpFilesize
408KB
-
memory/1076-59-0x0000000000930000-0x0000000000950000-memory.dmpFilesize
128KB