629ec1eb6367512fcb4d7c5e83eb110401ea58cd121cbb8ff0d29f6792a1250f

General

Target

Shipment doc, INV,BL+PL.exe
Size

458KB
MD5

c2c075d90b26a93560b684c1d11e3257
SHA1

16f34e7ac25b9b317abd82d57484b1ee194b928a
SHA256

629ec1eb6367512fcb4d7c5e83eb110401ea58cd121cbb8ff0d29f6792a1250f
SHA512

f8d2a5d37979cf3112a7e12c2147398f9f5174d44ed02338cb96fa98ac91c469e874c831887c6612db75baf11186e4c77a5c90048dde2ffa2cbc4008813783d9

Score

1^/10

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 324	1552	Shipment doc, INV,BL+PL.exe	24
PID 1552 wrote to memory of 324	1552	Shipment doc, INV,BL+PL.exe	24
PID 1552 wrote to memory of 324	1552	Shipment doc, INV,BL+PL.exe	24
PID 1552 wrote to memory of 732	1552	Shipment doc, INV,BL+PL.exe	26
PID 1552 wrote to memory of 732	1552	Shipment doc, INV,BL+PL.exe	26
PID 1552 wrote to memory of 732	1552	Shipment doc, INV,BL+PL.exe	26
PID 1552 wrote to memory of 1520	1552	Shipment doc, INV,BL+PL.exe	27
PID 1552 wrote to memory of 1520	1552	Shipment doc, INV,BL+PL.exe	27
PID 1552 wrote to memory of 1520	1552	Shipment doc, INV,BL+PL.exe	27
PID 1552 wrote to memory of 1508	1552	Shipment doc, INV,BL+PL.exe	28
PID 1552 wrote to memory of 1508	1552	Shipment doc, INV,BL+PL.exe	28
PID 1552 wrote to memory of 1508	1552	Shipment doc, INV,BL+PL.exe	28
PID 1552 wrote to memory of 1484	1552	Shipment doc, INV,BL+PL.exe	29
PID 1552 wrote to memory of 1484	1552	Shipment doc, INV,BL+PL.exe	29
PID 1552 wrote to memory of 1484	1552	Shipment doc, INV,BL+PL.exe	29
PID 1552 wrote to memory of 1692	1552	Shipment doc, INV,BL+PL.exe	30
PID 1552 wrote to memory of 1692	1552	Shipment doc, INV,BL+PL.exe	30
PID 1552 wrote to memory of 1692	1552	Shipment doc, INV,BL+PL.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	Shipment doc, INV,BL+PL.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
324	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1552
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WjVeyCQw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp848A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:324
- C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
  "{path}"
  2⤵
  PID:732
- C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
  "{path}"
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
  "{path}"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
  "{path}"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\Shipment doc, INV,BL+PL.exe
  "{path}"
  2⤵
  PID:1692