Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
13-11-2023 08:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hesap hareketi-01.pdf.exe
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
hesap hareketi-01.pdf.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
hesap hareketi-01.pdf.exe
-
Size
487KB
-
MD5
293c9d06f1b938d4a1bb0a060404d7d1
-
SHA1
17e3aade049a3dfab29bcd2982fb12a80ff0c0f6
-
SHA256
7d4e342fb24835aa40212a132e2434eef693bba64d765317bf57728df10ecd82
-
SHA512
b0d303ce28c1d1f0d1cc33b340e034ea2887ce8794df537a02c4c88a1ca879727394e4e89cc82858cbba054577430aa12339a4f1144b26cd37357eb10fb36b24
-
SSDEEP
12288:z0Vog2URL8umvZEpo0tqBwKYe6HnLwZJoKUfvyegFEHQ:zNMmv+pBk2eL9e1w
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
hesap hareketi-01.pdf.exepid process 2136 hesap hareketi-01.pdf.exe 2136 hesap hareketi-01.pdf.exe 2136 hesap hareketi-01.pdf.exe 2136 hesap hareketi-01.pdf.exe 2136 hesap hareketi-01.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hesap hareketi-01.pdf.exedescription pid process Token: SeDebugPrivilege 2136 hesap hareketi-01.pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
hesap hareketi-01.pdf.exedescription pid process target process PID 2136 wrote to memory of 2628 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2628 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2628 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2628 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2700 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2700 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2700 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2700 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2716 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2716 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2716 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2716 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2720 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2720 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2720 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2720 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2748 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2748 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2748 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe PID 2136 wrote to memory of 2748 2136 hesap hareketi-01.pdf.exe hesap hareketi-01.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"2⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"2⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"2⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"2⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesap hareketi-01.pdf.exe"2⤵PID:2748