Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2023 02:04

General

  • Target

    Oznamenie o Platbe_Postova Banka_Pdf.exe

  • Size

    46KB

  • MD5

    e6a54ac9fc726f9e97bf504300cce3b2

  • SHA1

    735ef8962bd6a9e4f45d7b9e03d6b5066923bfd5

  • SHA256

    c552b8ecaf95f50de9d1bd6e73bd241227d202b483cc6f9179d9a9b88ad796a1

  • SHA512

    ca5ac209f710e7a7d9fbf2d32258548afe757b149869d68257bd4fda6499c78c9174e4763991f1b6c27846038a6c286b3f465643b57bf8e1bfb19a7f48a24f5a

  • SSDEEP

    768:ebFP85m9v/hW+i20vMu/eDFxm5a2pc1SdwBLObtNGF58b60sADZEpYinAMxK6dQ:eRP8ka+BuCxiaY/SB4LGH06gi7HxLdQ

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Oznamenie o Platbe_Postova Banka_Pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Oznamenie o Platbe_Postova Banka_Pdf.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1504-0-0x0000000000910000-0x0000000000920000-memory.dmp

    Filesize

    64KB

  • memory/1504-1-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1504-2-0x00000000042D0000-0x0000000004310000-memory.dmp

    Filesize

    256KB

  • memory/1504-3-0x0000000000260000-0x0000000000266000-memory.dmp

    Filesize

    24KB

  • memory/1504-4-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1504-5-0x00000000042D0000-0x0000000004310000-memory.dmp

    Filesize

    256KB