Analysis
- max time kernel
140s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
12/07/2023, 12:26
General
- Target PO#HG666788YH_pdf.exe
- Size 327KB
- Sample230712-pl6vyseb2t
- SHA256 f60f5975350a5c5ce7067446e5b1ebf033c4dd6e84e8246bbfd9779762ddde8a
Malware Config
Signatures
- Drops startup file 2 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#HG666788YH_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#HG666788YH_pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\PO#HG666788YH_pdf.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfupdate.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PO#HG666788YH_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#HG666788YH_pdf.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 10602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1748 -ip 17481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zeyyep1n.gls.ps1
memory/1748-137-0x0000000005990000-0x0000000005F34000-memory.dmp
memory/1748-138-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/1748-139-0x0000000005570000-0x000000000560C000-memory.dmp
memory/1748-136-0x00000000009A0000-0x00000000009F8000-memory.dmp
memory/1748-141-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/2052-140-0x0000000002C80000-0x0000000002CB6000-memory.dmp
memory/2052-144-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/2052-142-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/2052-145-0x00000000054C0000-0x00000000054E2000-memory.dmp
memory/2052-146-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/2052-147-0x0000000005F40000-0x0000000005FA6000-memory.dmp
memory/2052-143-0x00000000058A0000-0x0000000005EC8000-memory.dmp
memory/2052-157-0x0000000006620000-0x000000000663E000-memory.dmp
memory/2052-158-0x0000000006B90000-0x0000000006C26000-memory.dmp
memory/2052-159-0x0000000006B00000-0x0000000006B1A000-memory.dmp
memory/2052-160-0x0000000006B50000-0x0000000006B72000-memory.dmp