6bddbc25a806579601538d6be846c09c61735fa2198ee7bdcfabb5317e406191

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO#00986.pdf.exe
Size

643KB
MD5

7923c45dcf8871cb20f281986f081b55
SHA1

3d2ffb801be1739263d70add078292f62b3490b9
SHA256

bd03f21ffe0e1b5628a0f890aeb7c186e2330a4e59e554f675fee7994ed3ea5d
SHA512

e254a23f14fded53dea4f3b69d4451b924f391bed5e444baaf6a0482e830aa4561b54a339107f995eaf24d74ba3c88b3d814f77fcfd533801bc4fac2c0c64b0d
SSDEEP

12288:YCWJp09bewSsnk/ZFCNP8n1LrhKGZw7QOLcXo/enFp33CT9wglb9YIE:YCF9bewS6WZQPO1/hKQwf4Xg2pnCT9wf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2216 set thread context of 2520	2216	PO#00986.pdf.exe	30

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe
2520	PO#00986.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	PO#00986.pdf.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30
PID 2216 wrote to memory of 2520	2216	PO#00986.pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-8-0x0000000004E40000-0x0000000004EB4000-memory.dmp

Filesize
464KB

Download
memory/2216-14-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/2216-2-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2216-3-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/2216-4-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/2216-5-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2216-6-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/2216-7-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/2216-0-0x0000000000F00000-0x0000000000FA8000-memory.dmp

Filesize
672KB

Download
memory/2216-1-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2520-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-16-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Filesize
3.0MB

Download
memory/2520-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download