Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2024 11:50

General

  • Target

    QUOTATION_AUGQTRA071244PDF.scr

  • Size

    536KB

  • MD5

    28124125948fb6bae67b89b9178a6f27

  • SHA1

    b6be8e9d920cd386bcf50dc5162a46b9cc3f7162

  • SHA256

    5af4024bb6dbdb97ad79ff6908f61e636162c9fe274dc7b4c0540c2057b106ab

  • SHA512

    d9c807ad51b4b2111631706bb38624a6414f47c293868ab4d9f83c7caf5dc2708af5e4996d815fca357bc594c79d051c838fc0875c5455931b1bc19b1b1ca870

  • SSDEEP

    3072:ZY0SvG7buDuqbPWc/+qmGZrLOUF1GsIUB21ZFzvqVkzwMYLsINQA4L3v9T72Mip8:Z0+7DXcpZrLOUF1/Y1ZRVYfp4fc6gW

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUGQTRA071244PDF.scr
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUGQTRA071244PDF.scr" /S
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1932-0-0x00007FF8BD7B3000-0x00007FF8BD7B5000-memory.dmp

    Filesize

    8KB

  • memory/1932-1-0x0000025505960000-0x00000255059EA000-memory.dmp

    Filesize

    552KB

  • memory/1932-2-0x00007FF8BD7B0000-0x00007FF8BE271000-memory.dmp

    Filesize

    10.8MB

  • memory/1932-3-0x00007FF8BD7B3000-0x00007FF8BD7B5000-memory.dmp

    Filesize

    8KB

  • memory/1932-4-0x00007FF8BD7B0000-0x00007FF8BE271000-memory.dmp

    Filesize

    10.8MB