Analysis
-
max time kernel
9s -
max time network
40s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
08-10-2021 08:48
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and Packing list.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and Packing list.exe
Resource
win10v20210408
General
-
Target
Shipment Document BL,INV and Packing list.exe
-
Size
25KB
-
MD5
bd1b61722ae264d4f00a0fb412d12bc0
-
SHA1
4188fa6acae6960268d2bc0512aea9dc08ba7486
-
SHA256
58a5be83221386f1bae87b2a785b08c758591bcbc235b21132240feece1972bc
-
SHA512
8feff8a854015545ac3b92d1e2d3242957ca504c6b5d89160951e64421c8c06d0643a6af3a6a436901eae43790741a642d8a71c91330bfccefcbfccb808ba6f6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 984 powershell.exe 1836 powershell.exe 628 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exeShipment Document BL,INV and Packing list.exedescription pid process Token: SeDebugPrivilege 984 powershell.exe Token: SeDebugPrivilege 1836 powershell.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 524 Shipment Document BL,INV and Packing list.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Shipment Document BL,INV and Packing list.exeShipment Document BL,INV and Packing list.exedescription pid process target process PID 1384 wrote to memory of 524 1384 Shipment Document BL,INV and Packing list.exe Shipment Document BL,INV and Packing list.exe PID 1384 wrote to memory of 524 1384 Shipment Document BL,INV and Packing list.exe Shipment Document BL,INV and Packing list.exe PID 1384 wrote to memory of 524 1384 Shipment Document BL,INV and Packing list.exe Shipment Document BL,INV and Packing list.exe PID 1384 wrote to memory of 524 1384 Shipment Document BL,INV and Packing list.exe Shipment Document BL,INV and Packing list.exe PID 524 wrote to memory of 984 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 984 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 984 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 984 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 1836 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 1836 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 1836 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 1836 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 628 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 628 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 628 524 Shipment Document BL,INV and Packing list.exe powershell.exe PID 524 wrote to memory of 628 524 Shipment Document BL,INV and Packing list.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list.exe" Demo2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
043f8b5857a382b28f0be60620f49e66
SHA110b270337b2389e6175081ca4b9ddc589f1ac48f
SHA2563281b32ef0afaac539adde6d02c8286ce11d17d65c58e3c9ca191ee757fb977c
SHA5122d0ae4eb8027e04646ef0b484ff6ab106f01cb82880296b905fc4e06a7a4a23bd4558002a8c67be1d3c28fe8a5712968e6076cb3a0ce0dfeb3dda920b2da614a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
043f8b5857a382b28f0be60620f49e66
SHA110b270337b2389e6175081ca4b9ddc589f1ac48f
SHA2563281b32ef0afaac539adde6d02c8286ce11d17d65c58e3c9ca191ee757fb977c
SHA5122d0ae4eb8027e04646ef0b484ff6ab106f01cb82880296b905fc4e06a7a4a23bd4558002a8c67be1d3c28fe8a5712968e6076cb3a0ce0dfeb3dda920b2da614a
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/524-56-0x0000000000000000-mapping.dmp
-
memory/524-76-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/628-68-0x0000000000000000-mapping.dmp
-
memory/628-75-0x0000000002410000-0x000000000305A000-memory.dmpFilesize
12.3MB
-
memory/984-64-0x0000000000382000-0x0000000000384000-memory.dmpFilesize
8KB
-
memory/984-63-0x0000000000381000-0x0000000000382000-memory.dmpFilesize
4KB
-
memory/984-62-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/984-60-0x0000000000000000-mapping.dmp
-
memory/1384-55-0x00000000768C1000-0x00000000768C3000-memory.dmpFilesize
8KB
-
memory/1384-53-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1836-65-0x0000000000000000-mapping.dmp
-
memory/1836-71-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/1836-73-0x00000000023C1000-0x00000000023C2000-memory.dmpFilesize
4KB
-
memory/1836-74-0x00000000023C2000-0x00000000023C4000-memory.dmpFilesize
8KB