Overview

overview

7

Static

static

Waybill.doc.exe

windows7_x64

7

Waybill.doc.exe

windows10_x64

3

Analysis

  • max time kernel
    150s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    13-07-2020 06:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Waybill.doc.exe

  • Size

    244KB

  • MD5

    846b1e88956d891648750465642f6222

  • SHA1

    349dbdf816fdaf2176c32a48ce354ab86e64210c

  • SHA256

    73ce18f3e68ee4af4c74629f5041241b31fd96226aa9d28c641faae949fb0d3b

  • SHA512

    f09893abf172e5ca7e61921d34cb8b8afe6b0da5e21985b9fd612ec6282ef59bb447e9013751f8d401f3de33a3484e85b807610792bb4d910266d10dc5d7a7f9

Score
7/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious use of SetThreadContext 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe
      "C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:1032
      • C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe
        "{path}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        PID:1844
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:1876
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"
        3⤵
        • Deletes itself
        PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1032-1-0x0000000000000000-0x0000000000000000-disk.dmp
    Download
  • memory/1320-4-0x0000000006490000-0x00000000065B1000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/1844-2-0x0000000000400000-0x000000000042D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/1844-3-0x000000000041E300-mapping.dmp
    Download
  • memory/1876-5-0x0000000000000000-mapping.dmp
    Download
  • memory/1876-6-0x0000000000780000-0x00000000007A2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1876-8-0x0000000001ED0000-0x0000000001FCE000-memory.dmp
    Filesize

    1016KB

    Download
  • memory/1884-7-0x0000000000000000-mapping.dmp
    Download