f72a28baaee398dbbd65efbdae0cf4864f208f806f4592f8f6bb7c9a735c2362

Analysis

max time kernel
47s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/03/2023, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Statement of Account.pdf.exe
Size 639KB
Sample230330-hfr2aabc55
SHA256 f72a28baaee398dbbd65efbdae0cf4864f208f806f4592f8f6bb7c9a735c2362
MD5 2224d84e4d75b85aa447e2a0bb5bfdc8
SHA1 f9afd500770a423c06ea55122f26c510626fd391
SHA512 f1ec27ebe21576c4a9db8eecbe4e8790f3d3bc8d52fcc5baf851bdc9f8911919c3807b99879d36785998c7fd12d5898a654fdce5e4f660969a97f4b71216064d
SSDEEP 12288:IeJ/sIAglhcnUwW+g35AX1MsrAOqWls5Rqc81vNIumLsqZjItimOMt+j:Nyn/WSFMJXWlBvNzmgqZjOimX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
760	Statement of Account.pdf.exe
760	Statement of Account.pdf.exe
760	Statement of Account.pdf.exe
760	Statement of Account.pdf.exe
760	Statement of Account.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	Statement of Account.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1156	760	Statement of Account.pdf.exe	28
PID 760 wrote to memory of 1156	760	Statement of Account.pdf.exe	28
PID 760 wrote to memory of 1156	760	Statement of Account.pdf.exe	28
PID 760 wrote to memory of 1156	760	Statement of Account.pdf.exe	28
PID 760 wrote to memory of 588	760	Statement of Account.pdf.exe	29
PID 760 wrote to memory of 588	760	Statement of Account.pdf.exe	29
PID 760 wrote to memory of 588	760	Statement of Account.pdf.exe	29
PID 760 wrote to memory of 588	760	Statement of Account.pdf.exe	29
PID 760 wrote to memory of 332	760	Statement of Account.pdf.exe	30
PID 760 wrote to memory of 332	760	Statement of Account.pdf.exe	30
PID 760 wrote to memory of 332	760	Statement of Account.pdf.exe	30
PID 760 wrote to memory of 332	760	Statement of Account.pdf.exe	30
PID 760 wrote to memory of 996	760	Statement of Account.pdf.exe	31
PID 760 wrote to memory of 996	760	Statement of Account.pdf.exe	31
PID 760 wrote to memory of 996	760	Statement of Account.pdf.exe	31
PID 760 wrote to memory of 996	760	Statement of Account.pdf.exe	31
PID 760 wrote to memory of 1380	760	Statement of Account.pdf.exe	32
PID 760 wrote to memory of 1380	760	Statement of Account.pdf.exe	32
PID 760 wrote to memory of 1380	760	Statement of Account.pdf.exe	32
PID 760 wrote to memory of 1380	760	Statement of Account.pdf.exe	32

C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
  2⤵
  PID:1156
- C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
  2⤵
  PID:588
- C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Statement of Account.pdf.exe"
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-54-0x0000000000390000-0x0000000000434000-memory.dmp

Download

memory/760-55-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/760-56-0x00000000006D0000-0x00000000006DA000-memory.dmp

Download

memory/760-57-0x00000000006D0000-0x00000000006DA000-memory.dmp

Download

memory/760-58-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/760-59-0x0000000000710000-0x000000000071E000-memory.dmp

Download

memory/760-60-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/760-61-0x00000000006D0000-0x00000000006DA000-memory.dmp

Download

memory/760-62-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/760-63-0x0000000001EC0000-0x0000000001ECC000-memory.dmp

Download

memory/760-64-0x0000000005890000-0x00000000058FE000-memory.dmp

Download

memory/760-65-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/760-66-0x0000000002000000-0x0000000002028000-memory.dmp

Download