Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2023, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RFQpdf.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
RFQpdf.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
RFQpdf.exe
-
Size
812KB
-
MD5
bdf0e665cab0bcd095c1ccf5f912e5f0
-
SHA1
5b399e5b64104276cd166712d04c1982f5e686f8
-
SHA256
8da7f3f5c82fa1468900d1f92ba263d74d62d0ec4c2128d4aaa260a0baca27a3
-
SHA512
ebbac37d4c13a172d3b14e8d04307feea41da0f5e27668d0fc2900bc9eaeebc2aa1b60251e955a6505b47def7a06381193020381e8c1dbeb7c15ad7015177754
-
SSDEEP
24576:qjsXDW2HXHS78SyXhx9D9cU+AsBHeXmxrkSOS2NCyZFkz:ysXDW23HSobD9cJAsBHeW7slZaz
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4924 set thread context of 372 4924 RFQpdf.exe 84 -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe 372 Regsvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4924 RFQpdf.exe Token: SeDebugPrivilege 372 Regsvcs.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84 PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84 PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84 PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84 PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84 PID 4924 wrote to memory of 372 4924 RFQpdf.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQpdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQpdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372
-