e9a11e6b848b855b9de1d62c8c5d75bb5b850b9e93b2d9d49ee9422950eff9ce

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-09-2022 12:16

Target

SWIFT_IMG_20220901_00078666587900.pdf.exe
Size

18KB
MD5

3ed262a5efb4d40d672c223b158a6b8a
SHA1

8cfdcaab8fa52ed91f52fadef21a8489d24e5011
SHA256

e9a11e6b848b855b9de1d62c8c5d75bb5b850b9e93b2d9d49ee9422950eff9ce
SHA512

bca13e92ef2b67556df52cfa4f187be5c7bf8c4ea8d4799a5729dd680031f42c4e648aa47db49798785797dbd69f9f68f9b49165b16c62f02ea73435f1f6f42d
SSDEEP

384:XasMoP+isALT5me9CI/euqrnHaFVoJagj6JKA4Q27u1wGuhGm:L3sE9LPdzNsXvuuGIG

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	SWIFT_IMG_20220901_00078666587900.pdf.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT_IMG_20220901_00078666587900.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT_IMG_20220901_00078666587900.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1328-54-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/1328-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download