Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ASCD0001 INQ9829......pdf.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ASCD0001 INQ9829......pdf.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
ASCD0001 INQ9829......pdf.exe
-
Size
840KB
-
MD5
57b1ad0359c449cd533a34db4fc81a9d
-
SHA1
a28948d8b7456cc3e3ac2aaf244bbc35cee76b85
-
SHA256
fcb012805679bb99ffeb9f535f06e1c5940b53d773f527e3a9aef5371540a199
-
SHA512
40c1a56b489b94313093abda622cdb1e1d295ba867666a667a1160f4a2a47616000189cc31caa833e9d01a32aef0f57b3d7cb6bfc05e27b74ac7f6c0455a930b
-
SSDEEP
24576:Qw4bjw4bDmrejmh1ezUjX/sCDQzPcbgV7:Qw4bjw4bDljtUjPsCDQgbw
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
ASCD0001 INQ9829......pdf.exepid process 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe 2092 ASCD0001 INQ9829......pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ASCD0001 INQ9829......pdf.exedescription pid process Token: SeDebugPrivilege 2092 ASCD0001 INQ9829......pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ASCD0001 INQ9829......pdf.exedescription pid process target process PID 2092 wrote to memory of 2720 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2720 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2720 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2720 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2532 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2532 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2532 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2532 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2740 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2740 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2740 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2740 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2612 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2612 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2612 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2612 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2988 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2988 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2988 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe PID 2092 wrote to memory of 2988 2092 ASCD0001 INQ9829......pdf.exe ASCD0001 INQ9829......pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"2⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"2⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"2⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"2⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"C:\Users\Admin\AppData\Local\Temp\ASCD0001 INQ9829......pdf.exe"2⤵PID:2988
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2092-0-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/2092-1-0x00000000003C0000-0x0000000000496000-memory.dmpFilesize
856KB
-
memory/2092-2-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2092-3-0x0000000000500000-0x000000000051A000-memory.dmpFilesize
104KB
-
memory/2092-4-0x00000000003B0000-0x00000000003C0000-memory.dmpFilesize
64KB
-
memory/2092-5-0x0000000005630000-0x00000000056B4000-memory.dmpFilesize
528KB
-
memory/2092-6-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/2092-7-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2092-8-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB