Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 08:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DBG1435766.pdf.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
DBG1435766.pdf.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
DBG1435766.pdf.exe
-
Size
642KB
-
MD5
c96b1ab041b5de0d12add2c508811d2e
-
SHA1
6312de7b19a06e5c4841c6ec610e9d3479d49ae5
-
SHA256
58e4540c1c53bc7bdcaa26de63fdff31ac8b6db3746c11aa20d0267e8bf83108
-
SHA512
5b9f29070170b6602205a2597c008db85d04dc3b3767fd78f40aaac19e5a733fb635c19304b94b031477783c6366b9b232907816c6bcc3febc712a274c0c4ee9
-
SSDEEP
12288:P/YoBqcgsIg8CmihkBOmYBmhud+/S9qDXrVMz0MKF7IYXQTCsVx3K9i72l:4onJh4ZhR7VMYb7IBVUkE
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBG1435766.pdf.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe 2324 DBG1435766.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2324 DBG1435766.pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2216 2324 DBG1435766.pdf.exe 31 PID 2324 wrote to memory of 2216 2324 DBG1435766.pdf.exe 31 PID 2324 wrote to memory of 2216 2324 DBG1435766.pdf.exe 31 PID 2324 wrote to memory of 2216 2324 DBG1435766.pdf.exe 31 PID 2324 wrote to memory of 2156 2324 DBG1435766.pdf.exe 32 PID 2324 wrote to memory of 2156 2324 DBG1435766.pdf.exe 32 PID 2324 wrote to memory of 2156 2324 DBG1435766.pdf.exe 32 PID 2324 wrote to memory of 2156 2324 DBG1435766.pdf.exe 32 PID 2324 wrote to memory of 2424 2324 DBG1435766.pdf.exe 33 PID 2324 wrote to memory of 2424 2324 DBG1435766.pdf.exe 33 PID 2324 wrote to memory of 2424 2324 DBG1435766.pdf.exe 33 PID 2324 wrote to memory of 2424 2324 DBG1435766.pdf.exe 33 PID 2324 wrote to memory of 2300 2324 DBG1435766.pdf.exe 34 PID 2324 wrote to memory of 2300 2324 DBG1435766.pdf.exe 34 PID 2324 wrote to memory of 2300 2324 DBG1435766.pdf.exe 34 PID 2324 wrote to memory of 2300 2324 DBG1435766.pdf.exe 34 PID 2324 wrote to memory of 2480 2324 DBG1435766.pdf.exe 35 PID 2324 wrote to memory of 2480 2324 DBG1435766.pdf.exe 35 PID 2324 wrote to memory of 2480 2324 DBG1435766.pdf.exe 35 PID 2324 wrote to memory of 2480 2324 DBG1435766.pdf.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"2⤵PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"2⤵PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"2⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"2⤵PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DBG1435766.pdf.exe"2⤵PID:2480
-