Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 11:27

General

  • Target

    Items IMG16092024.pdf.exe

  • Size

    957KB

  • MD5

    e24b9ef302a36051801a4d27e5563350

  • SHA1

    f7ca82fcd4fc8d02f6135ee4da09e3d0277421f0

  • SHA256

    337f2438ac48410b788b27c4d5a3668b67f1a7d5c1eb3d1c614dfd1652b5a42d

  • SHA512

    5ebae13b999767baaa6ba52792b8da9e66c814911fe147a90b0e6b4b072533ca12f5447a40bb4832278c381e584223f4ad5dc5bdf8f3c656bf7e7451d7500ffe

  • SSDEEP

    24576:jL7opqubED/7h4y9VATErHoJUG79VkxxKIR5e:rkFahvJrR290

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Items IMG16092024.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Items IMG16092024.pdf.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 804
      2⤵
      • Program crash
      PID:3420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2992-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

    Filesize

    4KB

  • memory/2992-1-0x0000000000810000-0x0000000000906000-memory.dmp

    Filesize

    984KB

  • memory/2992-3-0x00000000049B0000-0x0000000004A96000-memory.dmp

    Filesize

    920KB

  • memory/2992-2-0x0000000074E70000-0x000000007555E000-memory.dmp

    Filesize

    6.9MB

  • memory/2992-4-0x00000000052A0000-0x0000000005388000-memory.dmp

    Filesize

    928KB

  • memory/2992-12-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-5-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-6-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-8-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-52-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-10-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-60-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-14-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-16-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-18-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-20-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-22-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-24-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-26-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-28-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-30-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-32-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-36-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-34-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-38-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-40-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-42-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-44-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-46-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-48-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-50-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-68-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-66-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-64-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-62-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-58-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-56-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-54-0x00000000052A0000-0x0000000005381000-memory.dmp

    Filesize

    900KB

  • memory/2992-1079-0x0000000074E70000-0x000000007555E000-memory.dmp

    Filesize

    6.9MB

  • memory/2992-1080-0x0000000005480000-0x00000000054E2000-memory.dmp

    Filesize

    392KB

  • memory/2992-1081-0x00000000021A0000-0x00000000021EC000-memory.dmp

    Filesize

    304KB

  • memory/2992-1082-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

    Filesize

    4KB

  • memory/2992-1083-0x0000000074E70000-0x000000007555E000-memory.dmp

    Filesize

    6.9MB

  • memory/2992-1084-0x00000000056E0000-0x0000000005734000-memory.dmp

    Filesize

    336KB