Overview

overview

7

Static

static

Shipping D...ft.exe

windows7_x64

7

Shipping D...ft.exe

windows10_x64

3

Analysis

  • max time kernel
    128s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    30-06-2020 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipping Document PL&BL Draft.exe

  • Size

    617KB

  • MD5

    4c3f776751b7ead0c297f8f55e341958

  • SHA1

    90f5c2887b4a31d4d30bb73eed64cb9c8ccd87c8

  • SHA256

    d476a544163ada2f782fea0b457a59f167825b5d7a0be161400070d919543f54

  • SHA512

    897ee8713639c1fe49f8151f0239f57e53bfb0a2c31fd666583ad7f416eb1fbaccd5dc9e6f1b3b92daf230f9f14a011e339033c4c98b008f5f1f0f14b5f429b2

Score
3/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 960
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Program crash
      PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1912-0-0x0000000004640000-0x0000000004641000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1912-1-0x0000000004640000-0x0000000004641000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1912-3-0x0000000004640000-0x0000000004641000-memory.dmp
    Filesize

    4KB

    Download