b3fb3ea182da19c8e66b870740d3e954b709c507d2dabee80f5f6975bc4fafe5

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG-02873009pdf.exe
Size

2.0MB
MD5

87e4e76d8e2df4e2ef4311fb94a6ab5d
SHA1

1c8e4db718e20d4beaca8693b3035b31f512e67b
SHA256

16bac81cbed6b7de8ceb6634ea6c5777d2e2f5b255c781a68c47398bb7025ae0
SHA512

d610124b7cbc1a4ab0af9781fcf8d65a28e45f7f101c1a096dae560ac2b746e20cd66607e6cddc5abc4da22135e066352fa2d0984e59470c3618b534b008e626
SSDEEP

49152:12IaSCoAu/ZjhTtnBGl8qCkvoPqPxE34b:fCoAsheskvoSV

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uawhkr = "C:\\Users\\Admin\\AppData\\Roaming\\Uawhkr.exe"	IMG-02873009pdf.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe
1212	IMG-02873009pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	IMG-02873009pdf.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1368	1212	IMG-02873009pdf.exe	28
PID 1212 wrote to memory of 1368	1212	IMG-02873009pdf.exe	28
PID 1212 wrote to memory of 1368	1212	IMG-02873009pdf.exe	28
PID 1212 wrote to memory of 1368	1212	IMG-02873009pdf.exe	28
PID 1212 wrote to memory of 652	1212	IMG-02873009pdf.exe	29
PID 1212 wrote to memory of 652	1212	IMG-02873009pdf.exe	29
PID 1212 wrote to memory of 652	1212	IMG-02873009pdf.exe	29
PID 1212 wrote to memory of 652	1212	IMG-02873009pdf.exe	29
PID 1212 wrote to memory of 2348	1212	IMG-02873009pdf.exe	30
PID 1212 wrote to memory of 2348	1212	IMG-02873009pdf.exe	30
PID 1212 wrote to memory of 2348	1212	IMG-02873009pdf.exe	30
PID 1212 wrote to memory of 2348	1212	IMG-02873009pdf.exe	30
PID 1212 wrote to memory of 1912	1212	IMG-02873009pdf.exe	31
PID 1212 wrote to memory of 1912	1212	IMG-02873009pdf.exe	31
PID 1212 wrote to memory of 1912	1212	IMG-02873009pdf.exe	31
PID 1212 wrote to memory of 1912	1212	IMG-02873009pdf.exe	31
PID 1212 wrote to memory of 1088	1212	IMG-02873009pdf.exe	32
PID 1212 wrote to memory of 1088	1212	IMG-02873009pdf.exe	32
PID 1212 wrote to memory of 1088	1212	IMG-02873009pdf.exe	32
PID 1212 wrote to memory of 1088	1212	IMG-02873009pdf.exe	32
PID 1212 wrote to memory of 1136	1212	IMG-02873009pdf.exe	33
PID 1212 wrote to memory of 1136	1212	IMG-02873009pdf.exe	33
PID 1212 wrote to memory of 1136	1212	IMG-02873009pdf.exe	33
PID 1212 wrote to memory of 1136	1212	IMG-02873009pdf.exe	33
PID 1212 wrote to memory of 1128	1212	IMG-02873009pdf.exe	34
PID 1212 wrote to memory of 1128	1212	IMG-02873009pdf.exe	34
PID 1212 wrote to memory of 1128	1212	IMG-02873009pdf.exe	34
PID 1212 wrote to memory of 1128	1212	IMG-02873009pdf.exe	34
PID 1212 wrote to memory of 1776	1212	IMG-02873009pdf.exe	35
PID 1212 wrote to memory of 1776	1212	IMG-02873009pdf.exe	35
PID 1212 wrote to memory of 1776	1212	IMG-02873009pdf.exe	35
PID 1212 wrote to memory of 1776	1212	IMG-02873009pdf.exe	35
PID 1212 wrote to memory of 1332	1212	IMG-02873009pdf.exe	36
PID 1212 wrote to memory of 1332	1212	IMG-02873009pdf.exe	36
PID 1212 wrote to memory of 1332	1212	IMG-02873009pdf.exe	36
PID 1212 wrote to memory of 1332	1212	IMG-02873009pdf.exe	36
PID 1212 wrote to memory of 1528	1212	IMG-02873009pdf.exe	37
PID 1212 wrote to memory of 1528	1212	IMG-02873009pdf.exe	37
PID 1212 wrote to memory of 1528	1212	IMG-02873009pdf.exe	37
PID 1212 wrote to memory of 1528	1212	IMG-02873009pdf.exe	37

C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
"C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  C:\Users\Admin\AppData\Local\Temp\IMG-02873009pdf.exe
  2⤵
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-53-0x00000000002C0000-0x00000000004BE000-memory.dmp

Filesize
2.0MB

Download
memory/1212-54-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1212-55-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/1212-56-0x0000000005080000-0x0000000005146000-memory.dmp

Filesize
792KB

Download
memory/1212-57-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-58-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-60-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-62-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-64-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-66-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-68-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-70-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-72-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-74-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-76-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-78-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-80-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-82-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-84-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-86-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-88-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-90-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-92-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-94-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-96-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-98-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-100-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-102-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-104-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-106-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-108-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-110-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-112-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-114-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-116-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-118-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-120-0x0000000005080000-0x0000000005141000-memory.dmp

Filesize
772KB

Download
memory/1212-1133-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1212-1134-0x0000000000C30000-0x0000000000C72000-memory.dmp

Filesize
264KB

Download
memory/1212-1135-0x0000000000DB0000-0x0000000000DFC000-memory.dmp

Filesize
304KB

Download
memory/1212-1137-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download