bb5ffa744f85e8c00110008da647ab5a10aef58d50e927f70e78f02e2ac105de

Analysis

max time kernel
37s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zamwienie181WM24ZW_pdf.scr.exe
Size

46KB
MD5

1b3a17b5e26a738aaa141c0f82984f2d
SHA1

d14b0afef232fad0ecbc49bf8f91f096f9dac15b
SHA256

bb5ffa744f85e8c00110008da647ab5a10aef58d50e927f70e78f02e2ac105de
SHA512

a5e1603baa309167260f7f87b76c8b369232c4666f76471e343d6a006242f374bb2a5ddc98c489d6495b4cded8b50b84706e6498c8951c45336ba66da823f930
SSDEEP

768:3soeSY0ifcAfqg4mPLQKP2ZjATfUrhUzLgYmt/o/owf34LdmgWDu01L3x+1gO:3soeSYDfc/EU6K9I3mtyoEIRH6dc1gO

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NestlePureInstaller.vbs	Zamwienie181WM24ZW_pdf.scr.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2124	Zamwienie181WM24ZW_pdf.scr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	Zamwienie181WM24ZW_pdf.scr.exe
Token: SeDebugPrivilege	2124	Zamwienie181WM24ZW_pdf.scr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 5044	2124	Zamwienie181WM24ZW_pdf.scr.exe	30
PID 2124 wrote to memory of 5044	2124	Zamwienie181WM24ZW_pdf.scr.exe	30
PID 2124 wrote to memory of 5044	2124	Zamwienie181WM24ZW_pdf.scr.exe	30

C:\Users\Admin\AppData\Local\Temp\Zamwienie181WM24ZW_pdf.scr.exe
"C:\Users\Admin\AppData\Local\Temp\Zamwienie181WM24ZW_pdf.scr.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 1076
  2⤵
  PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x000007FEF6423000-0x000007FEF6424000-memory.dmp

Filesize
4KB

Download
memory/2124-1-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

Filesize
64KB

Download
memory/2124-2-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2124-3-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-4-0x000000001C480000-0x000000001C588000-memory.dmp

Filesize
1.0MB

Download
memory/2124-5-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-18-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-14-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-12-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-10-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-8-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-6-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-16-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-24-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-36-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-52-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-62-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-68-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-66-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-64-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-60-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-58-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-56-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-54-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-50-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-48-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-46-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-44-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-42-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-40-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-38-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-34-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-32-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-30-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-28-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-26-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-23-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-20-0x000000001C480000-0x000000001C582000-memory.dmp

Filesize
1.0MB

Download
memory/2124-1328-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1327-0x000007FEF6423000-0x000007FEF6424000-memory.dmp

Filesize
4KB

Download
memory/2124-1329-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1331-0x000000001B110000-0x000000001B16E000-memory.dmp

Filesize
376KB

Download
memory/2124-1332-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1333-0x000000001ACA0000-0x000000001ACEC000-memory.dmp

Filesize
304KB

Download
memory/2124-1334-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1330-0x000000001A750000-0x000000001A7B2000-memory.dmp

Filesize
392KB

Download
memory/2124-1335-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1336-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1337-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1338-0x000000001B3F0000-0x000000001B444000-memory.dmp

Filesize
336KB

Download
memory/2124-1341-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1342-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download