Analysis
-
max time kernel
584s -
max time network
614s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
20-10-2021 15:55
Static task
static1
Behavioral task
behavioral1
Sample
Product Inquire List.doc.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Product Inquire List.doc.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
Product Inquire List.doc.exe
-
Size
440KB
-
MD5
05270120d0e5f9d72a2809c6bf5180b0
-
SHA1
ba724979e7f6f46ac33e096180ad531c1a37e9ca
-
SHA256
0a2521fb76fe94f9c8dff781b757fde0eabebb9abcc5038a6e2bc1a0fa17458e
-
SHA512
647e209489afcf38c81ad61060c5e70e4a6d0d5aa6a2a4941cbbbf1980cb4252fdb5a180f39a5b8556d4e9974350e56f47dd9db4db74d81bb84e992c9d56fc1f
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Product Inquire List.doc.exepid process 1656 Product Inquire List.doc.exe 1656 Product Inquire List.doc.exe 1656 Product Inquire List.doc.exe 1656 Product Inquire List.doc.exe 1656 Product Inquire List.doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Product Inquire List.doc.exedescription pid process Token: SeDebugPrivilege 1656 Product Inquire List.doc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Product Inquire List.doc.exedescription pid process target process PID 1656 wrote to memory of 1356 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1356 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1356 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1356 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1520 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1520 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1520 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1520 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1124 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1124 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1124 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1124 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1504 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1504 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1504 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 1504 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 556 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 556 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 556 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe PID 1656 wrote to memory of 556 1656 Product Inquire List.doc.exe Product Inquire List.doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"C:\Users\Admin\AppData\Local\Temp\Product Inquire List.doc.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-53-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1656-55-0x0000000074F81000-0x0000000074F83000-memory.dmpFilesize
8KB
-
memory/1656-56-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/1656-57-0x0000000000900000-0x0000000000907000-memory.dmpFilesize
28KB
-
memory/1656-58-0x0000000004CA0000-0x0000000004CF8000-memory.dmpFilesize
352KB