Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30/05/2023, 06:54
General
-
Target
Image PDF.exe
-
Size
189KB
-
MD5
fcd532931cbee93b33fec3b865847411
-
SHA1
5b59b18fbc8218cb554e90af2449757d90aa116a
-
SHA256
3b026f6a862b24e645a4696c79169960332752e2aa15d92081d9c101062f1c7f
-
SHA512
ca9125c4dcb89842add947d505e77780d5ec2660d90a5a5ccaf1b9d6c8e3e4984734be423670bd06e68dde7f7f2d0ba1246adcf8f072b4f8d025b732e0a1e70c
-
SSDEEP
3072:oqbtYfYoWAvduC9hVWYiEVcPAMFP0+SbzdEgFqFRJ4H2M/dOxdJz9ry1K7pGIR9l:obzWkd9hV/GJ6+2l/oNzwd
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Image PDF.exe"C:\Users\Admin\AppData\Local\Temp\Image PDF.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
624KB
-
Filesize
1.8MB
-
Filesize
64KB