Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7 - submitted
30/06/2020, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Shipment Document BL,INV and Packing list Attached.exe
- Size 334KB
- Sample200630-bwwj53py2n
- SHA256 172be7bb49ca26c5c67465ac2581d08f6301ffccf25fd319e3bc408db5c8a4d3
- MD5 e961d77e00c45f04a0d35f0568556432
- SHA1 4137b1a66c92dd0db5d1458d0fb8d3a048147663
- SHA512 5d4b79b889ad2d24d7231e5d81d39aa02e2738ead1093386b60ac7a0cde50afe76ba6e57b187c2193fab7591ae8a9597ec33f5bdc61c41f6edc67a6d2617c6ad
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1492 wrote to memory of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 1228 wrote to memory of 1044 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1044 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1044 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1044 1228 Explorer.EXE 25 PID 1044 wrote to memory of 1032 1044 chkdsk.exe 26 PID 1044 wrote to memory of 1032 1044 chkdsk.exe 26 PID 1044 wrote to memory of 1032 1044 chkdsk.exe 26 PID 1044 wrote to memory of 1032 1044 chkdsk.exe 26 - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1492 set thread context of 388 1492 Shipment Document BL,INV and Packing list Attached.exe 24 PID 388 set thread context of 1228 388 Shipment Document BL,INV and Packing list Attached.exe 20 PID 388 set thread context of 1228 388 Shipment Document BL,INV and Packing list Attached.exe 20 PID 1044 set thread context of 1228 1044 chkdsk.exe 20 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 388 Shipment Document BL,INV and Packing list Attached.exe 388 Shipment Document BL,INV and Packing list Attached.exe 388 Shipment Document BL,INV and Packing list Attached.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 388 Shipment Document BL,INV and Packing list Attached.exe Token: SeDebugPrivilege 1044 chkdsk.exe - Deletes itself 1 IoCs
pid Process 1032 cmd.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 388 Shipment Document BL,INV and Packing list Attached.exe 388 Shipment Document BL,INV and Packing list Attached.exe 388 Shipment Document BL,INV and Packing list Attached.exe 388 Shipment Document BL,INV and Packing list Attached.exe 1044 chkdsk.exe 1044 chkdsk.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:388
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Enumerates system info in registry
PID:1044 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"3⤵
- Deletes itself
PID:1032
-
-