Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
19/05/2023, 06:38
General
-
Target
HSBC Payment Advice_pdf.exe
-
Size
799KB
-
MD5
ad0f1127ea2e0a563c8863684b42657d
-
SHA1
df3e2c75d399e2c5104ba80565e7d380766d3fc2
-
SHA256
907939021dfc3946ca5395b6a318ac3957e069725e5689968522a58ae81d0ab4
-
SHA512
7abe6a3013c1a998fa75ca02cf73e71dd4c11140cc9981cf5e1145854b31f33b6fc6bd6a2b665809634b2e860c600aa40b98c6972b3a19e25ae037dcbfa1fa56
-
SSDEEP
12288:B0gifordrIOMq5o6IAb2FGGAu6XnwEG4ArzPd4Ly6:B0jopUOMq5jISsQ+DrLdL
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
816KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB