Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 01:47
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and Packing list Attached.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Shipment Document BL,INV and Packing list Attached.exe
-
Size
334KB
-
MD5
e961d77e00c45f04a0d35f0568556432
-
SHA1
4137b1a66c92dd0db5d1458d0fb8d3a048147663
-
SHA256
172be7bb49ca26c5c67465ac2581d08f6301ffccf25fd319e3bc408db5c8a4d3
-
SHA512
5d4b79b889ad2d24d7231e5d81d39aa02e2738ead1093386b60ac7a0cde50afe76ba6e57b187c2193fab7591ae8a9597ec33f5bdc61c41f6edc67a6d2617c6ad
Score
5/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Shipment Document BL,INV and Packing list Attached.exeExplorer.EXEcmd.exedescription pid process target process PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1516 wrote to memory of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 2984 wrote to memory of 2068 2984 Explorer.EXE cmd.exe PID 2984 wrote to memory of 2068 2984 Explorer.EXE cmd.exe PID 2984 wrote to memory of 2068 2984 Explorer.EXE cmd.exe PID 2068 wrote to memory of 2204 2068 cmd.exe cmd.exe PID 2068 wrote to memory of 2204 2068 cmd.exe cmd.exe PID 2068 wrote to memory of 2204 2068 cmd.exe cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipment Document BL,INV and Packing list Attached.exeShipment Document BL,INV and Packing list Attached.execmd.exedescription pid process target process PID 1516 set thread context of 1892 1516 Shipment Document BL,INV and Packing list Attached.exe Shipment Document BL,INV and Packing list Attached.exe PID 1892 set thread context of 2984 1892 Shipment Document BL,INV and Packing list Attached.exe Explorer.EXE PID 2068 set thread context of 2984 2068 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Shipment Document BL,INV and Packing list Attached.execmd.exepid process 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe 2068 cmd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Shipment Document BL,INV and Packing list Attached.execmd.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1892 Shipment Document BL,INV and Packing list Attached.exe Token: SeDebugPrivilege 2068 cmd.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipment Document BL,INV and Packing list Attached.execmd.exepid process 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 1892 Shipment Document BL,INV and Packing list Attached.exe 2068 cmd.exe 2068 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1892-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1892-1-0x000000000041E2B0-mapping.dmp
-
memory/2068-2-0x0000000000000000-mapping.dmp
-
memory/2068-3-0x0000000001210000-0x0000000001269000-memory.dmpFilesize
356KB
-
memory/2068-4-0x0000000001210000-0x0000000001269000-memory.dmpFilesize
356KB
-
memory/2068-6-0x0000000003E40000-0x0000000003F47000-memory.dmpFilesize
1.0MB
-
memory/2204-5-0x0000000000000000-mapping.dmp