922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859

Analysis

max time kernel
240s
max time network
245s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/09/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_SEPQTRA071244.PDF.scr
Size

353KB
MD5

631691dca7abc573a0cc911b2ddca40e
SHA1

0ddc497bb233cda946e320378cde5e5cc507eb72
SHA256

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859
SHA512

4a94910b35a95038ba787095970ee32281011021f3cd33066bc8b350c2b1824e1f67a303492fbaae41e9872e75667325e3a4b8d759dce3a79105a00a09782dd9
SSDEEP

768:BiHqbOcbd5LGOcccCM8AMx9m24IeGFfRhQg2ZzEjss2VSg1I1cn0sspAgpq8hLy8:oHqbbJGwrThRhQ7qPpqOLy0uyL+fS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1872	QUOTATION_SEPQTRA071244.PDF.scr
1872	QUOTATION_SEPQTRA071244.PDF.scr
1872	QUOTATION_SEPQTRA071244.PDF.scr
1872	QUOTATION_SEPQTRA071244.PDF.scr

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	QUOTATION_SEPQTRA071244.PDF.scr
Token: SeDebugPrivilege	1872	QUOTATION_SEPQTRA071244.PDF.scr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 5960	1872	QUOTATION_SEPQTRA071244.PDF.scr	31
PID 1872 wrote to memory of 5960	1872	QUOTATION_SEPQTRA071244.PDF.scr	31
PID 1872 wrote to memory of 5960	1872	QUOTATION_SEPQTRA071244.PDF.scr	31

C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244.PDF.scr
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244.PDF.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1872 -s 1612
  2⤵
  PID:5960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-0-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/1872-1-0x0000000001060000-0x00000000010BC000-memory.dmp

Filesize
368KB

Download
memory/1872-2-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/1872-3-0x000000001C100000-0x000000001C202000-memory.dmp

Filesize
1.0MB

Download
memory/1872-4-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-23-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-13-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-29-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-27-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-25-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-49-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-51-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-47-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-63-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-61-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-21-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-19-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-17-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-15-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-67-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-65-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-59-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-57-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-55-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-53-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-45-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-43-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-41-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-39-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-37-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-35-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-33-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-31-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-11-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-9-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-7-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-6-0x000000001C100000-0x000000001C1FB000-memory.dmp

Filesize
1004KB

Download
memory/1872-1079-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/1872-1078-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/1872-1080-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/1872-1082-0x0000000000F60000-0x0000000000FAC000-memory.dmp

Filesize
304KB

Download
memory/1872-1081-0x00000000008E0000-0x000000000095C000-memory.dmp

Filesize
496KB

Download
memory/1872-1083-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/1872-1084-0x000000001AF40000-0x000000001AF94000-memory.dmp

Filesize
336KB

Download