abe0a6708bda47a3fad184d79e29e780300ce705aa45f04ee506e055ed50dbb8

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RQ039423.PDF.exe
Size

745KB
MD5

a9236435368f55bbb462fd7d03a832b2
SHA1

75d703203a24ff7e6a0f451598837d57304bfa27
SHA256

abe0a6708bda47a3fad184d79e29e780300ce705aa45f04ee506e055ed50dbb8
SHA512

e19dc3e29dd1138bb4067f41168ae458811b0713f0f6530199b7a3fa4429de306bbb929dcf9b74058937250db02514d38aab820862c8b88e35b5fdbf0554b697
SSDEEP

12288:pv953k9WSr3qJlVsLGxQKDx/MDJI/BLHCPtUKSVgVI3ny6iZ7btZIlrcHewyQJ3y:pvnk9RMlV1xQKDx/MDJqBLsUNyC3x+7Z

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2820	2196	RQ039423.PDF.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	RegSvcs.exe
2820	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30
PID 2196 wrote to memory of 2820	2196	RQ039423.PDF.exe	30

C:\Users\Admin\AppData\Local\Temp\RQ039423.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RQ039423.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-17-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-0-0x0000000000300000-0x00000000003C0000-memory.dmp

Filesize
768KB

Download
memory/2196-2-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/2196-3-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/2196-4-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-5-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/2196-6-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/2196-7-0x0000000000680000-0x000000000068E000-memory.dmp

Filesize
56KB

Download
memory/2196-8-0x0000000007DA0000-0x0000000007E1A000-memory.dmp

Filesize
488KB

Download
memory/2196-1-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-21-0x0000000073740000-0x0000000073E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-22-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2820-23-0x0000000073740000-0x0000000073E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-24-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download