5d89a25cf8029f781b53b9cc617c5067cafe366eb58d0b76ee4246e519f794b0 | Triage™

Analysis

max time kernel
125s
max time network
125s
platform
windows10_x64
resource
win10v20210410
submitted
16/05/2021, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revised invoice and packing list pdf.exe
Size 1.7MB
Sample210516-bvwt8bv196
SHA256 5d89a25cf8029f781b53b9cc617c5067cafe366eb58d0b76ee4246e519f794b0
MD5 290f9c5600c777852717d8067d4ae783
SHA1 0c45b1fc5758e00e83f85994a40c2b0c19f910af
SHA512 390c8b740e71eb238bb904ba09bc4fad25f8c20a2df28c00046d4dfee562bd07341b93c20902b52054b2ff0c70eb4c433b89adcde5bfab66183e363b3bea1446
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	dw20.exe
3044	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3044	dw20.exe
Token: SeBackupPrivilege	3044	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3044	3992	revised invoice and packing list pdf.exe	76
PID 3992 wrote to memory of 3044	3992	revised invoice and packing list pdf.exe	76
PID 3992 wrote to memory of 3044	3992	revised invoice and packing list pdf.exe	76

C:\Users\Admin\AppData\Local\Temp\revised invoice and packing list pdf.exe
"C:\Users\Admin\AppData\Local\Temp\revised invoice and packing list pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 892
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-114-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download