Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 01:49
General
- Target ACTA No. 0124000157695484408.pdf.exe
- Size 4.4MB
- Sample240613-b8yafazelf
- SHA256 d0d13be890e9642e8301282526792678c6c70f859c303edc5a30d64a647d96c3
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACTA No. 0124000157695484408.pdf.exe"C:\Users\Admin\AppData\Local\Temp\ACTA No. 0124000157695484408.pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/708-0-0x000000007538E000-0x000000007538F000-memory.dmp
memory/708-1-0x0000000000E20000-0x0000000001292000-memory.dmp
memory/708-2-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/708-3-0x0000000005DD0000-0x0000000006218000-memory.dmp
memory/708-4-0x0000000007350000-0x0000000007576000-memory.dmp
memory/708-5-0x0000000007B20000-0x00000000080C4000-memory.dmp
memory/708-6-0x0000000007610000-0x00000000076A2000-memory.dmp
memory/708-8-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-7-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-20-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-32-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-36-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-46-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-56-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-54-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-52-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-50-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-48-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-45-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-42-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-40-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-38-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-34-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-30-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-26-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-28-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-24-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-22-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-16-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-14-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-12-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-10-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-18-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-58-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-69-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-64-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-62-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-60-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-70-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-66-0x0000000007350000-0x000000000756F000-memory.dmp
memory/708-4893-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/708-4895-0x0000000006400000-0x000000000644C000-memory.dmp
memory/708-4894-0x00000000063A0000-0x0000000006400000-memory.dmp
memory/708-4896-0x000000007538E000-0x000000007538F000-memory.dmp
memory/708-4897-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/708-4898-0x0000000006600000-0x0000000006654000-memory.dmp
memory/708-4903-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/2480-4902-0x0000000000400000-0x000000000041A000-memory.dmp
memory/2480-4904-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/2480-4905-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/2480-4906-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/2480-4907-0x0000000075380000-0x0000000075B30000-memory.dmp