8d7e74f25af31e7367fa67a638e9efe741632fc9db0af6364f385238ed9d62f7 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
26-01-2022 20:37

Sharing

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

50KB
MD5

9856b9dcbe55777dc78532fbb170ff64
SHA1

96f764731753aafd6682fe9f4adcca85b0b2244d
SHA256

63d8b5ed48256724991369af3d390fca0bba9afcc1d1dee674b6484632ed8ab5
SHA512

7ec1b57f9f79e831b58e5f5052f1619b8d3b1cc4c9fe787942a0f818315ab788d0814565732ce9636741d2c59584d9da2315af4347d675721f2e1daf2c8cebd0

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Shipping Documents.exe

pid process

1632 Shipping Documents.exe
1632 Shipping Documents.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Shipping Documents.exe

description pid process

Token: SeDebugPrivilege 1632 Shipping Documents.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Shipping Documents.exe

description	pid	process	target process
PID 1632 wrote to memory of 1628	1632	Shipping Documents.exe	aspnet_compiler.exe
PID 1632 wrote to memory of 1628	1632	Shipping Documents.exe	aspnet_compiler.exe
PID 1632 wrote to memory of 1628	1632	Shipping Documents.exe	aspnet_compiler.exe
PID 1632 wrote to memory of 1628	1632	Shipping Documents.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-55-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

Filesize
72KB

Download
memory/1632-56-0x000000001B1A0000-0x000000001B1A2000-memory.dmp

Filesize
8KB

Download
memory/1632-57-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download