f4d615d355758ca68e3948655172d591d87a137671cb3c8cf0ebc367d1764494 | Triage™

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220414-en
submitted
05/07/2022, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHIPPING DOCUMENTS (BILL-NGC#5011728784).exe
Size 176KB
Sample220705-ewyl8adhcl
SHA256 f4d615d355758ca68e3948655172d591d87a137671cb3c8cf0ebc367d1764494
MD5 5e5e00a40992d0f054ffc248dc28677e
SHA1 6af0f96516f3e1eb6a4d79ad4c2d3ea28e346902
SHA512 d7e60942246c4679a938eb54a0d33e6ce366bf6a833af57b326783e18c467ff174c9b007928eeff243d081a405b5640a93c69b571c390730cd6a1e257ec2d37f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	SHIPPING DOCUMENTS (BILL-NGC#5011728784).exe

C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS (BILL-NGC#5011728784).exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS (BILL-NGC#5011728784).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000001370000-0x00000000013A2000-memory.dmp

Download

memory/536-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Download