Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:41
Static task
static1
Behavioral task
behavioral1
Sample
shipment documents for SST2112-250..exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
shipment documents for SST2112-250..exe
-
Size
607KB
-
MD5
014283a3f74600a5e3184d54d4b9134a
-
SHA1
f9e163b967fd02e060aaf4020abe6f9e96150526
-
SHA256
16478611c7b79652c9256355bc0498b0695d26d5a297011a672a5bac9ca40b76
-
SHA512
01060df227a236cf449c61dcda359ff4b437b89c5491727173afa095bc579a9381106084bbaa463e29e227126bb608563b03c3fe29763e2e1af7135703af5e20
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
shipment documents for SST2112-250..exepid process 1720 shipment documents for SST2112-250..exe 1720 shipment documents for SST2112-250..exe 1720 shipment documents for SST2112-250..exe 1720 shipment documents for SST2112-250..exe 1720 shipment documents for SST2112-250..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
shipment documents for SST2112-250..exedescription pid process Token: SeDebugPrivilege 1720 shipment documents for SST2112-250..exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
shipment documents for SST2112-250..exedescription pid process target process PID 1720 wrote to memory of 1328 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1328 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1328 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1328 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 852 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 852 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 852 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 852 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 632 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 632 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 632 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 632 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1308 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1308 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1308 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1308 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1780 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1780 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1780 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe PID 1720 wrote to memory of 1780 1720 shipment documents for SST2112-250..exe shipment documents for SST2112-250..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-54-0x00000000003E0000-0x000000000047E000-memory.dmpFilesize
632KB
-
memory/1720-55-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000000230000-0x000000000023A000-memory.dmpFilesize
40KB
-
memory/1720-57-0x0000000007E30000-0x0000000007EB4000-memory.dmpFilesize
528KB
-
memory/1720-58-0x0000000000600000-0x0000000000632000-memory.dmpFilesize
200KB