Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10v200430 - submitted
30/06/2020, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Shipment Document BL,INV and Packing list Attached.exe
- Size 334KB
- Sample200630-bwwj53py2n
- SHA256 172be7bb49ca26c5c67465ac2581d08f6301ffccf25fd319e3bc408db5c8a4d3
- MD5 e961d77e00c45f04a0d35f0568556432
- SHA1 4137b1a66c92dd0db5d1458d0fb8d3a048147663
- SHA512 5d4b79b889ad2d24d7231e5d81d39aa02e2738ead1093386b60ac7a0cde50afe76ba6e57b187c2193fab7591ae8a9597ec33f5bdc61c41f6edc67a6d2617c6ad
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 2984 wrote to memory of 2068 2984 Explorer.EXE 73 PID 2984 wrote to memory of 2068 2984 Explorer.EXE 73 PID 2984 wrote to memory of 2068 2984 Explorer.EXE 73 PID 2068 wrote to memory of 2204 2068 cmd.exe 74 PID 2068 wrote to memory of 2204 2068 cmd.exe 74 PID 2068 wrote to memory of 2204 2068 cmd.exe 74 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1516 set thread context of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe 72 PID 1892 set thread context of 2984 1892 Shipment Document BL,INV and Packing list Attached.exe 56 PID 2068 set thread context of 2984 2068 cmd.exe 56 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1892 Shipment Document BL,INV and Packing list Attached.exe Token: SeDebugPrivilege 2068 cmd.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 2068 cmd.exe 2068 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2068 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"3⤵PID:2204
-
-