5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_SEPQTRA071244.PDF.scr
Size

368KB
MD5

51f72822ddf3ea7523d116ff4328c22f
SHA1

70e22a50a272f9cecac73153e812fa9d140edd4d
SHA256

5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9
SHA512

9bc35c63f3fbf48d362d7132925d27880333a13e2cdc2b0cbd9f1040475b410701aa1791504f92559622f44d99ab5cd3ece37ec7b8682685fc86e69b0937540b
SSDEEP

384:OJGY/HAGNn06CjFN8P3YsU6fCWYA8S/hs/E2sofOh/Q0RbnqRGt/KzVtBBU:OJVdNdM8sScR9ApqcAg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3008	QUOTATION_SEPQTRA071244.PDF.scr
3008	QUOTATION_SEPQTRA071244.PDF.scr
3008	QUOTATION_SEPQTRA071244.PDF.scr
3008	QUOTATION_SEPQTRA071244.PDF.scr

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	QUOTATION_SEPQTRA071244.PDF.scr
Token: SeDebugPrivilege	3008	QUOTATION_SEPQTRA071244.PDF.scr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1720	3008	QUOTATION_SEPQTRA071244.PDF.scr	32
PID 3008 wrote to memory of 1720	3008	QUOTATION_SEPQTRA071244.PDF.scr	32
PID 3008 wrote to memory of 1720	3008	QUOTATION_SEPQTRA071244.PDF.scr	32

C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244.PDF.scr
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_SEPQTRA071244.PDF.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3008 -s 1668
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x00000000013A0000-0x0000000001400000-memory.dmp

Filesize
384KB

Download
memory/3008-2-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/3008-3-0x000000001C710000-0x000000001C812000-memory.dmp

Filesize
1.0MB

Download
memory/3008-9-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-67-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-65-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-1079-0x0000000000E80000-0x0000000000ECC000-memory.dmp

Filesize
304KB

Download
memory/3008-1080-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/3008-1078-0x000000001B350000-0x000000001B3CC000-memory.dmp

Filesize
496KB

Download
memory/3008-61-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-59-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-57-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-55-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-53-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-51-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-49-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-45-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-43-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-41-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-39-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-37-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-35-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-33-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-31-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-29-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-27-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-25-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-23-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-21-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-19-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-17-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-15-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-13-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-11-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-63-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-47-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-7-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-5-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-4-0x000000001C710000-0x000000001C80B000-memory.dmp

Filesize
1004KB

Download
memory/3008-1081-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/3008-1082-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/3008-1083-0x000000001AC20000-0x000000001AC74000-memory.dmp

Filesize
336KB

Download