Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 13:34
Static task
static1
Behavioral task
behavioral1
Sample
Waybill.doc.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Waybill.doc.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Waybill.doc.exe
-
Size
244KB
-
MD5
846b1e88956d891648750465642f6222
-
SHA1
349dbdf816fdaf2176c32a48ce354ab86e64210c
-
SHA256
73ce18f3e68ee4af4c74629f5041241b31fd96226aa9d28c641faae949fb0d3b
-
SHA512
f09893abf172e5ca7e61921d34cb8b8afe6b0da5e21985b9fd612ec6282ef59bb447e9013751f8d401f3de33a3484e85b807610792bb4d910266d10dc5d7a7f9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1384 1768 Waybill.doc.exe 24 PID 1768 wrote to memory of 1384 1768 Waybill.doc.exe 24 PID 1768 wrote to memory of 1384 1768 Waybill.doc.exe 24 PID 1768 wrote to memory of 1384 1768 Waybill.doc.exe 24 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1768 wrote to memory of 1888 1768 Waybill.doc.exe 25 PID 1216 wrote to memory of 1924 1216 Explorer.EXE 26 PID 1216 wrote to memory of 1924 1216 Explorer.EXE 26 PID 1216 wrote to memory of 1924 1216 Explorer.EXE 26 PID 1216 wrote to memory of 1924 1216 Explorer.EXE 26 PID 1924 wrote to memory of 1932 1924 mstsc.exe 27 PID 1924 wrote to memory of 1932 1924 mstsc.exe 27 PID 1924 wrote to memory of 1932 1924 mstsc.exe 27 PID 1924 wrote to memory of 1932 1924 mstsc.exe 27 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1768 Waybill.doc.exe Token: SeDebugPrivilege 1888 Waybill.doc.exe Token: SeDebugPrivilege 1924 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1768 Waybill.doc.exe 1768 Waybill.doc.exe 1888 Waybill.doc.exe 1888 Waybill.doc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe 1924 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1888 Waybill.doc.exe 1888 Waybill.doc.exe 1888 Waybill.doc.exe 1924 mstsc.exe 1924 mstsc.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1768 set thread context of 1888 1768 Waybill.doc.exe 25 PID 1888 set thread context of 1216 1888 Waybill.doc.exe 20 PID 1924 set thread context of 1216 1924 mstsc.exe 20 -
Deletes itself 1 IoCs
pid Process 1932 cmd.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"{path}"3⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1888
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1924 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Waybill.doc.exe"3⤵
- Deletes itself
PID:1932
-
-