Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7 -
submitted
22-10-2020 07:32
Static task
static1
Behavioral task
behavioral1
Sample
Christmas Shipment 102120208586_PDF.exe
Resource
win7
Behavioral task
behavioral2
Sample
Christmas Shipment 102120208586_PDF.exe
Resource
win10v200722
General
-
Target
Christmas Shipment 102120208586_PDF.exe
-
Size
349KB
-
MD5
d83e43d9071e4db4af3cb776b5ec020c
-
SHA1
d4a4e658b5658901e62a17ae85cf15ec8051cad3
-
SHA256
3dd49a4c4138beb588bd295bdf95af66f5d4779cb1d70731a3702dd08c794d66
-
SHA512
f3aa967c4d7ad1294968b8e4e94ca51f171ecd003bb7709f9da006e4acdda8b8a40fdf3219b69afac7bbbb3cc0cd0198ce5978b75d8387b02f510bcb5e6fbf22
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSWOW.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSWOW.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Christmas Shipment 102120208586_PDF.exedescription pid process target process PID 1124 set thread context of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
Christmas Shipment 102120208586_PDF.exepid process 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe 1124 Christmas Shipment 102120208586_PDF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Christmas Shipment 102120208586_PDF.exeChristmas Shipment 102120208586_PDF.exedescription pid process Token: SeDebugPrivilege 1124 Christmas Shipment 102120208586_PDF.exe Token: SeDebugPrivilege 1920 Christmas Shipment 102120208586_PDF.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Christmas Shipment 102120208586_PDF.exedescription pid process target process PID 1124 wrote to memory of 1568 1124 Christmas Shipment 102120208586_PDF.exe cmd.exe PID 1124 wrote to memory of 1568 1124 Christmas Shipment 102120208586_PDF.exe cmd.exe PID 1124 wrote to memory of 1568 1124 Christmas Shipment 102120208586_PDF.exe cmd.exe PID 1124 wrote to memory of 1568 1124 Christmas Shipment 102120208586_PDF.exe cmd.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe PID 1124 wrote to memory of 1920 1124 Christmas Shipment 102120208586_PDF.exe Christmas Shipment 102120208586_PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Christmas Shipment 102120208586_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Christmas Shipment 102120208586_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\Christmas Shipment 102120208586_PDF.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSWOW.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\Christmas Shipment 102120208586_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Christmas Shipment 102120208586_PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSWOW.exeMD5
d83e43d9071e4db4af3cb776b5ec020c
SHA1d4a4e658b5658901e62a17ae85cf15ec8051cad3
SHA2563dd49a4c4138beb588bd295bdf95af66f5d4779cb1d70731a3702dd08c794d66
SHA512f3aa967c4d7ad1294968b8e4e94ca51f171ecd003bb7709f9da006e4acdda8b8a40fdf3219b69afac7bbbb3cc0cd0198ce5978b75d8387b02f510bcb5e6fbf22
-
memory/1124-0-0x0000000073F10000-0x00000000745FE000-memory.dmpFilesize
6.9MB
-
memory/1124-1-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/1124-3-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1568-4-0x0000000000000000-mapping.dmp
-
memory/1920-6-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1920-7-0x000000000044C77E-mapping.dmp
-
memory/1920-9-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1920-8-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1920-10-0x0000000073F10000-0x00000000745FE000-memory.dmpFilesize
6.9MB