Overview

overview

10

Static

static

AWB 989969...df.exe

windows7-x64

1

AWB 989969...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    42s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2022 07:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AWB 9899691012 Clearance Doc_pdf.exe

  • Size

    868KB

  • MD5

    a37e262817ae3d053fc1687173ecb232

  • SHA1

    815fa3fd46df27605ba8b20798b97fb1bb6aa022

  • SHA256

    ea2ae64afb2fe6c21176ec595cc4036a184e16c700c312aa8efa4280ab27c2c3

  • SHA512

    50cb991d722c5c026d4bbd1e1b6efe3b4c70dc84cf64b451dc396a9c5962acf25c2a6a0f47b941395177ce8578156e5a759bb9a0edc4288de7f8e068eb7e8507

  • SSDEEP

    12288:9oQgKZ/nXt7virmWhlGLaQYIHB2XzVqX/EwHVZuGkwDGnvPeYEVbW3wFV/T6oBt3:BeVqsit8nOlS3wFFOoBtbl

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
      2⤵
        PID:1696
      • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
        2⤵
          PID:1620
        • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
          2⤵
            PID:576
          • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
            2⤵
              PID:1500
            • C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe
              "C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 Clearance Doc_pdf.exe"
              2⤵
                PID:1100

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1752-54-0x0000000000370000-0x0000000000450000-memory.dmp
              Filesize

              896KB

              Download
            • memory/1752-55-0x0000000075111000-0x0000000075113000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1752-56-0x0000000000640000-0x0000000000656000-memory.dmp
              Filesize

              88KB

              Download
            • memory/1752-57-0x0000000000650000-0x000000000065E000-memory.dmp
              Filesize

              56KB

              Download
            • memory/1752-58-0x0000000005CB0000-0x0000000005D44000-memory.dmp
              Filesize

              592KB

              Download
            • memory/1752-59-0x0000000001FB0000-0x000000000200A000-memory.dmp
              Filesize

              360KB

              Download