6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_SEPQTRA071244úPDF.scr.exe
Size

497KB
MD5

60fdae7957c24a52dcb84aa1802edbd4
SHA1

4f38d0c6f43e8d6efaa6d4355d563213b0cf6866
SHA256

6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676
SHA512

9367458d72ba32b3e0542c94afc0ea6f3cf5c5fcbb17f45cac917ea1f35225292de9185a8b5df60e6bb43047c4546c638489addc41db4f052094224b053057fc
SSDEEP

1536:CH8HxsM08Tcgc92csCGlTyzUuZ0SVPRiNaQnFYUHKa/GUkgGPYSLgVay+Zm1SMhf:PZGmtFfqgOYSLgf+ZmRvV5FPV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2736	QUOTATION_SEPQTRA071244úPDF.scr.exe
2736	QUOTATION_SEPQTRA071244úPDF.scr.exe
2736	QUOTATION_SEPQTRA071244úPDF.scr.exe
2736	QUOTATION_SEPQTRA071244úPDF.scr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	QUOTATION_SEPQTRA071244úPDF.scr.exe
Token: SeDebugPrivilege	2736	QUOTATION_SEPQTRA071244úPDF.scr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 6112	2736	QUOTATION_SEPQTRA071244úPDF.scr.exe	31
PID 2736 wrote to memory of 6112	2736	QUOTATION_SEPQTRA071244úPDF.scr.exe	31
PID 2736 wrote to memory of 6112	2736	QUOTATION_SEPQTRA071244úPDF.scr.exe	31

C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244úPDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244úPDF.scr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 1516
  2⤵
  PID:6112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x00000000001D0000-0x0000000000250000-memory.dmp

Filesize
512KB

Download
memory/2736-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-3-0x000000001C4B0000-0x000000001C5B0000-memory.dmp

Filesize
1024KB

Download
memory/2736-4-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-9-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-5-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-21-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-7-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-11-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-15-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-19-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-23-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-25-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-27-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-17-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-13-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-33-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-29-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-67-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-65-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-63-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-61-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-59-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-57-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-55-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-53-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-51-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-49-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-47-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-45-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-1078-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-43-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-41-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-39-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-37-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-35-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-31-0x000000001C4B0000-0x000000001C5AB000-memory.dmp

Filesize
1004KB

Download
memory/2736-1080-0x0000000000760000-0x00000000007AC000-memory.dmp

Filesize
304KB

Download
memory/2736-1079-0x0000000002380000-0x00000000023FC000-memory.dmp

Filesize
496KB

Download
memory/2736-1081-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2736-1082-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-1083-0x00000000024B0000-0x0000000002504000-memory.dmp

Filesize
336KB

Download