Analysis
-
max time kernel
387s -
max time network
444s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
03-04-2023 17:14
General
-
Target
PDFpower (3).exe
-
Size
1.0MB
-
MD5
1e2a99ae43d6365148d412b5dfee0e1c
-
SHA1
33c02d70abb2f1f12a79cfd780d875a94e7fe877
-
SHA256
e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6
-
SHA512
d962f2e4bbeee0183a3b75f26ccc6de273c28fe5a191c83c1e4ea6c84c8f70b535273452e05c5e11e4df725cad3054e346ad0b3d98348718a00a350b87a5fa0c
-
SSDEEP
24576:sWjYtbXSRxqO8m657w6ZBLmkitKqBCjC0PDgM5A6:sW8tbiJVV1BCjB
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDFpower (3).exe"C:\Users\Admin\AppData\Local\Temp\PDFpower (3).exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
704KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
408KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB