Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 10:53
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Invoice.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipping Invoice.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Shipping Invoice.exe
-
Size
853KB
-
MD5
2a6aa0a5026ba0cb75c6a6c475b58da4
-
SHA1
01f3140e506a6b11bf9bd52bd3c49a8883d60690
-
SHA256
5f4e2a1354cd895b7deccd1e0e702bff02eee8aee5a388f98526b6e203ea131b
-
SHA512
e1a6530ddc0b8bb436d0104dc0b6c08f58ac20d1fa6029e1c2fcca5ed1fbfc34a49368412a609237f6180f2f4edd404d91b482d70cef3c71d321fb5601de3988
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Shipping Invoice.exepid process 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe 1688 Shipping Invoice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shipping Invoice.exedescription pid process Token: SeDebugPrivilege 1688 Shipping Invoice.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Shipping Invoice.exedescription pid process target process PID 1688 wrote to memory of 1552 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 1552 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 1552 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 1552 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 972 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 972 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 972 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 972 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 368 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 368 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 368 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 368 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 572 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 572 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 572 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 572 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 984 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 984 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 984 1688 Shipping Invoice.exe Shipping Invoice.exe PID 1688 wrote to memory of 984 1688 Shipping Invoice.exe Shipping Invoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Invoice.exe"2⤵