Overview

overview

6

Static

static

1

PDFpower (3).exe

windows10-1703-x64

6

Analysis

  • max time kernel
    363s
  • max time network
    441s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-04-2023 17:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PDFpower (3).exe

  • Size

    1.0MB

  • MD5

    1e2a99ae43d6365148d412b5dfee0e1c

  • SHA1

    33c02d70abb2f1f12a79cfd780d875a94e7fe877

  • SHA256

    e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6

  • SHA512

    d962f2e4bbeee0183a3b75f26ccc6de273c28fe5a191c83c1e4ea6c84c8f70b535273452e05c5e11e4df725cad3054e346ad0b3d98348718a00a350b87a5fa0c

  • SSDEEP

    24576:sWjYtbXSRxqO8m657w6ZBLmkitKqBCjC0PDgM5A6:sW8tbiJVV1BCjB

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PDFpower (3).exe
    "C:\Users\Admin\AppData\Local\Temp\PDFpower (3).exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    PID:4124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4124-116-0x0000000000460000-0x000000000056C000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4124-117-0x0000000004F00000-0x0000000004F10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-118-0x0000000005110000-0x00000000051C0000-memory.dmp
    Filesize

    704KB

    Download
  • memory/4124-119-0x0000000004D90000-0x0000000004D9A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4124-120-0x0000000005830000-0x0000000005D5C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/4124-122-0x0000000009CE0000-0x0000000009D46000-memory.dmp
    Filesize

    408KB

    Download
  • memory/4124-123-0x000000000A120000-0x000000000A158000-memory.dmp
    Filesize

    224KB

    Download
  • memory/4124-126-0x0000000004F00000-0x0000000004F10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-127-0x0000000004F00000-0x0000000004F10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-128-0x0000000004F00000-0x0000000004F10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-129-0x0000000004F00000-0x0000000004F10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-130-0x000000000B510000-0x000000000B532000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4124-131-0x000000000B540000-0x000000000B890000-memory.dmp
    Filesize

    3.3MB

    Download