Analysis
-
max time kernel
69s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
12/08/2022, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 711014151.pdf.exe
Resource
win7-20220715-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase Order 711014151.pdf.exe
Resource
win10v2004-20220721-en
14 signatures
150 seconds
General
-
Target
Purchase Order 711014151.pdf.exe
-
Size
709KB
-
MD5
88624e9e57c3471f10b62bf0afb40c4d
-
SHA1
d3b3df4c13d104d0b277cd243d9f5c1e6a673ead
-
SHA256
b5141a3c6323449bc7fc031d6eb2073fcbe97754c46eef0d0d8f937b9c2fb5cb
-
SHA512
b45c32c38416977b432b2e03b867e5e58be128e75ff2292bb07f820dec88636e7be63168b95e7413ddf86832239e138d68e8ec5fe70567e8e8cf11582919c041
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe 844 Purchase Order 711014151.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 844 Purchase Order 711014151.pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 844 wrote to memory of 1376 844 Purchase Order 711014151.pdf.exe 26 PID 844 wrote to memory of 1376 844 Purchase Order 711014151.pdf.exe 26 PID 844 wrote to memory of 1376 844 Purchase Order 711014151.pdf.exe 26 PID 844 wrote to memory of 1376 844 Purchase Order 711014151.pdf.exe 26 PID 844 wrote to memory of 728 844 Purchase Order 711014151.pdf.exe 27 PID 844 wrote to memory of 728 844 Purchase Order 711014151.pdf.exe 27 PID 844 wrote to memory of 728 844 Purchase Order 711014151.pdf.exe 27 PID 844 wrote to memory of 728 844 Purchase Order 711014151.pdf.exe 27 PID 844 wrote to memory of 932 844 Purchase Order 711014151.pdf.exe 28 PID 844 wrote to memory of 932 844 Purchase Order 711014151.pdf.exe 28 PID 844 wrote to memory of 932 844 Purchase Order 711014151.pdf.exe 28 PID 844 wrote to memory of 932 844 Purchase Order 711014151.pdf.exe 28 PID 844 wrote to memory of 960 844 Purchase Order 711014151.pdf.exe 29 PID 844 wrote to memory of 960 844 Purchase Order 711014151.pdf.exe 29 PID 844 wrote to memory of 960 844 Purchase Order 711014151.pdf.exe 29 PID 844 wrote to memory of 960 844 Purchase Order 711014151.pdf.exe 29 PID 844 wrote to memory of 956 844 Purchase Order 711014151.pdf.exe 30 PID 844 wrote to memory of 956 844 Purchase Order 711014151.pdf.exe 30 PID 844 wrote to memory of 956 844 Purchase Order 711014151.pdf.exe 30 PID 844 wrote to memory of 956 844 Purchase Order 711014151.pdf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"2⤵PID:1376
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"2⤵PID:728
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"2⤵PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"2⤵PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 711014151.pdf.exe"2⤵PID:956
-