270daae1261a5456d3a85fdd050e3f7c7f55ed69015bcffc1a4e958e2816a513

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 06:42

Target

Hesaphareketi-001,pdf.exe
Size

21KB
MD5

958ba282767aee7ee313ac28f4e010fd
SHA1

1d95529a755bfb1c39b79fd3915d55a95dec6a66
SHA256

270daae1261a5456d3a85fdd050e3f7c7f55ed69015bcffc1a4e958e2816a513
SHA512

f5a200471f933aa70d2e91745685e287f2a716a8ac97ddabbcd5ce43c8aa63cd75165ad4e6e944aaea72de155864cb9b734dab0d80edb530b2bbb35265f0dfd5
SSDEEP

384:KP4kZOL8LF7cS15iR/lW7VDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDyd5:KPfoQOYiR/lW7VDDDDDDDDDDDDDDDDDu

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	Hesaphareketi-001,pdf.exe

C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-001,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-001,pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1348-54-0x0000000001230000-0x000000000123C000-memory.dmp

Filesize
48KB

Download
memory/1348-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download