Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Consignment Details.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Consignment Details.exe
-
Size
3.0MB
-
MD5
13d99c2ac641f89128925263d6ddc4f4
-
SHA1
3e68058db2a6da752fd3e711955bed24440d6471
-
SHA256
55519e954b4b28f0d1497294eab96130c3932928fdf4a739c9a94a884379282f
-
SHA512
8aef281d74bdb0da823c4c91855563e82bf6bbbaaeb88a528d06992b59feeae64f1f6fbf4dc49e2d5e6de8dcfd9cabc2654b6a3acc5f7c30628c4d8d9f8285c5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Consignment Details.exepid process 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe 1268 Consignment Details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Consignment Details.exedescription pid process Token: SeDebugPrivilege 1268 Consignment Details.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 1268 wrote to memory of 1408 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1408 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1408 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1408 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1556 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1556 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1556 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1556 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1428 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1428 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1428 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1428 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 840 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 840 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 840 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 840 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1684 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1684 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1684 1268 Consignment Details.exe Consignment Details.exe PID 1268 wrote to memory of 1684 1268 Consignment Details.exe Consignment Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵