Analysis
- max time kernel
38s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
19/01/2022, 09:21
General
- Target Shipping documents for PO 810884,810904.exe
- Size 467KB
- Sample220119-lbbqaagfa6
- SHA256 ce53a88fb28e7708bc7eae3494d020093cb81e1a15c57713db1d755b2fb7baf5
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents for PO 810884,810904.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents for PO 810884,810904.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents for PO 810884,810904.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents for PO 810884,810904.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1556-136-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3016-130-0x0000000000F30000-0x0000000000FAC000-memory.dmp
memory/3016-131-0x0000000005EF0000-0x0000000006494000-memory.dmp
memory/3016-132-0x00000000059E0000-0x0000000005A72000-memory.dmp
memory/3016-133-0x0000000005970000-0x000000000597A000-memory.dmp
memory/3016-134-0x0000000005940000-0x0000000005EE4000-memory.dmp
memory/3016-135-0x0000000007A40000-0x0000000007ADC000-memory.dmp