79879e8ec6748d39187201ab487066c6376fb1470acb7fc549cef32e4bf87415

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SCTR11670000pdf.exe
Size

590KB
MD5

a9d25742936345bea8b04ccea8d734a6
SHA1

3095759333963b09c097ba18832cdc1485518964
SHA256

79879e8ec6748d39187201ab487066c6376fb1470acb7fc549cef32e4bf87415
SHA512

14b8ff4a4d4713fc12db50bfa07d5acc60d9f6204b4d156cbdf51b1e636a7669c59dd6202cfba8ab104bb5cdabab66b44e60105b15071d96e9cee3de202eefa3
SSDEEP

12288:/GL21ILyzQ2cWjoIN7khkqPiFKzuZ3q928rW2A2arldVKOOkJAS1gkR:uL21ILyzQrAykqWTZ3q9frW2A2ar3VKi

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

SCTR11670000pdf.exe

pid process

2732 SCTR11670000pdf.exe
2732 SCTR11670000pdf.exe
2732 SCTR11670000pdf.exe
2732 SCTR11670000pdf.exe
2732 SCTR11670000pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SCTR11670000pdf.exe

description pid process

Token: SeDebugPrivilege 2732 SCTR11670000pdf.exe

pid	process
2732	SCTR11670000pdf.exe
2732	SCTR11670000pdf.exe
2732	SCTR11670000pdf.exe
2732	SCTR11670000pdf.exe
2732	SCTR11670000pdf.exe

description	pid	process
Token: SeDebugPrivilege	2732	SCTR11670000pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

SCTR11670000pdf.exe

description	pid	process	target process
PID 2732 wrote to memory of 2720	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2720	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2720	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2720	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2896	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2896	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2896	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2896	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2564	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2564	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2564	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2564	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2540	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2540	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2540	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2540	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2888	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2888	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2888	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe
PID 2732 wrote to memory of 2888	2732	SCTR11670000pdf.exe	SCTR11670000pdf.exe

C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SCTR11670000pdf.exe"
  2⤵
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x00000000003B0000-0x0000000000446000-memory.dmp

Filesize
600KB

Download
memory/2732-1-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-2-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2732-3-0x0000000001E70000-0x0000000001E88000-memory.dmp

Filesize
96KB

Download
memory/2732-5-0x0000000001ED0000-0x0000000001EE4000-memory.dmp

Filesize
80KB

Download
memory/2732-4-0x0000000001E20000-0x0000000001E2E000-memory.dmp

Filesize
56KB

Download
memory/2732-6-0x0000000005DC0000-0x0000000005E22000-memory.dmp

Filesize
392KB

Download
memory/2732-7-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download