30a20d82d44b2c3ab9122cf88f156134484b9ed949cf99154b26fb8861b87a04 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 06:15

Sharing

Report Analysis Logs

General

Target

DHL AWB SHIPMENTS DOCS.exe
Size

44KB
MD5

620d7b7b9c75c1bd5a921927cc833248
SHA1

20822406537e8fbd03ec11faec991952c8cd134d
SHA256

c707ec1a12a940e07233173f3df3203e32dfcbc5771c455300cd84935b4062c9
SHA512

95f6747c0100f1dcc6481dc90cf2682412bcf9b40cc56b886f3f5b186875ed2acebffe6794c81967212173ff1f4cb3a97da0f3a42814d406770db679c5a0579a
SSDEEP

384:k9JBtLK/tFBfGh0rGjb2RbnxUSlXAo5Ga+m3oV:0jEKibUOXv5yh

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

description pid process

Token: SeDebugPrivilege 864 DHL AWB SHIPMENTS DOCS.exe

C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/864-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download