e7adc99d7eb2bf7b5cf6878236331755c1c57f7815a8a72cd322a341a99adbf0

Analysis

max time kernel
53s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2022, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipment Document BL,INV and packing list.jpg.exe
Size

233KB
MD5

53e4a3efc351af944cf2076a1dfcde1d
SHA1

80c499867152c4baa991cad6127478affdce6548
SHA256

054939c5e1c596a28eceffd6fc10e70b46f46a47e0fbc6cf341799368eb1c462
SHA512

9eb3e33602905ae0a5f7ed385eebc7fa4b55e21f1e6d902c38fc5e5a222f3324916ae8e689013eb98dbc382ad094eeb01d7017a97f2c4a6f0e86d9aec4d3589e
SSDEEP

3072:zQHNmk8c/c8LYxWk3T/PBfRBJjWs7AM1fldMW/3eVvIiWYV:VBrWkj/P1RBJjyF

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oMWPCxXz.lnk	Shipment Document BL,INV and packing list.jpg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	Shipment Document BL,INV and packing list.jpg.exe

C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4588-132-0x0000000000D10000-0x0000000000D50000-memory.dmp

Filesize
256KB

Download
memory/4588-133-0x0000000005700000-0x000000000579C000-memory.dmp

Filesize
624KB

Download
memory/4588-134-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download