6a470b74c05807c039f5a2a3b21fb6e33daf09ddc59cc6416ec44c971a0663aa

Analysis

max time kernel
239s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipping documents.exe
Size

960KB
MD5

a0b2a10e84abe8930570103f841bcc75
SHA1

441c100f5467f1e7983b3e62119b60bb3cc757d7
SHA256

ebb86221b5c4336e8155321c3ef818e39e38c981227b768433d107ba6aa3bd69
SHA512

023c0e59dbdd9dd8f3b2e3ad99154942d651e7b3c3b498e25d957fb4b717dde7148a932bc1cfd1a4a9679889fcaa22de8b25d75ae14f01e12c3a25ef248794d5
SSDEEP

24576:EGU376CRkFg/IyXtBbvShFasPKhCX0sTLZeD1zBCh:2PkoXvSLSkzTNk1W

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Shipping documents.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Shipping documents.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1512 schtasks.exe

pid	process
1512	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Shipping documents.exe

description	pid	process	target process
PID 3496 wrote to memory of 1512	3496	Shipping documents.exe	schtasks.exe
PID 3496 wrote to memory of 1512	3496	Shipping documents.exe	schtasks.exe
PID 3496 wrote to memory of 1512	3496	Shipping documents.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iRqvNpf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp347F.tmp"
2⤵
- Creates scheduled task(s)
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp347F.tmp
Filesize
1KB

MD5
221803d18d9362b2e1f2cb87cc9882eb

SHA1
60a1a5a88b94a0011cf81ebe628a238a495ed0ea

SHA256
468e0000fc1ee8aecd9f71bdaef9b732451d1d17299bad6eebbc3ef725b84c4e

SHA512
eb7bb7d5abd350d6a2c8050967295c243ca5f23ba35ce5d9ccad7aba0526398d209dcaa7e1a6427f7ba41ff62dc7287b0cf847a238647f6a1307ae26694f237b

Download Submit
memory/1512-137-0x0000000000000000-mapping.dmp

Download
memory/3496-132-0x0000000000AC0000-0x0000000000BB6000-memory.dmp

Filesize
984KB

Download
memory/3496-133-0x0000000005B80000-0x0000000006124000-memory.dmp

Filesize
5.6MB

Download
memory/3496-134-0x00000000055D0000-0x0000000005662000-memory.dmp

Filesize
584KB

Download
memory/3496-135-0x0000000005710000-0x00000000057AC000-memory.dmp

Filesize
624KB

Download
memory/3496-136-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download