922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_SEPQTRA071244úPDF.scr.exe
Size

353KB
MD5

631691dca7abc573a0cc911b2ddca40e
SHA1

0ddc497bb233cda946e320378cde5e5cc507eb72
SHA256

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859
SHA512

4a94910b35a95038ba787095970ee32281011021f3cd33066bc8b350c2b1824e1f67a303492fbaae41e9872e75667325e3a4b8d759dce3a79105a00a09782dd9
SSDEEP

768:BiHqbOcbd5LGOcccCM8AMx9m24IeGFfRhQg2ZzEjss2VSg1I1cn0sspAgpq8hLy8:oHqbbJGwrThRhQ7qPpqOLy0uyL+fS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1836	QUOTATION_SEPQTRA071244úPDF.scr.exe
1836	QUOTATION_SEPQTRA071244úPDF.scr.exe
1836	QUOTATION_SEPQTRA071244úPDF.scr.exe
1836	QUOTATION_SEPQTRA071244úPDF.scr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	QUOTATION_SEPQTRA071244úPDF.scr.exe
Token: SeDebugPrivilege	1836	QUOTATION_SEPQTRA071244úPDF.scr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2628	1836	QUOTATION_SEPQTRA071244úPDF.scr.exe	32
PID 1836 wrote to memory of 2628	1836	QUOTATION_SEPQTRA071244úPDF.scr.exe	32
PID 1836 wrote to memory of 2628	1836	QUOTATION_SEPQTRA071244úPDF.scr.exe	32

C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244úPDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244úPDF.scr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1836 -s 1604
  2⤵
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1836-1-0x0000000001110000-0x000000000116C000-memory.dmp

Filesize
368KB

Download
memory/1836-2-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1836-3-0x000000001AE10000-0x000000001AF12000-memory.dmp

Filesize
1.0MB

Download
memory/1836-7-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-41-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-67-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-1079-0x0000000000D20000-0x0000000000D6C000-memory.dmp

Filesize
304KB

Download
memory/1836-1080-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1836-1078-0x0000000000F00000-0x0000000000F7C000-memory.dmp

Filesize
496KB

Download
memory/1836-65-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-63-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-61-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-59-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-57-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-55-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-53-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-51-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-49-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-47-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-45-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-43-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-39-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-37-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-35-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-33-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-31-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-29-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-27-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-25-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-23-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-21-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-19-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-17-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-15-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-13-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-9-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-11-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-5-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-4-0x000000001AE10000-0x000000001AF0B000-memory.dmp

Filesize
1004KB

Download
memory/1836-1081-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1836-1082-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1836-1083-0x000000001BDA0000-0x000000001BDF4000-memory.dmp

Filesize
336KB

Download