d8bcf863b8af5d3a0622ab2fe468752219a1e80e85ccb1e7d29608cb49350f46

Analysis

max time kernel
71s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fedex Invoice-XXXXX4210-02032023073135894221.exe
Size 717KB
Sample230321-l7dvhsbf8s
SHA256 d8bcf863b8af5d3a0622ab2fe468752219a1e80e85ccb1e7d29608cb49350f46
MD5 de6fc7d0e2f09392c8cb71f654630a24
SHA1 0ca91ef01e929c91cd5aff5d1623623a0d21eb76
SHA512 fd9f3af82e37f5f4973b38a5af149d2d33f0838c3c1fea2a62dfe2ad23f1412992ff1f54dc52e98ed152e5a3fa70447f24c99257d6080fa1c1a0f29189dffeaf
SSDEEP 12288:jEJnFe40pox9o4+QYa80uAg9P5/iEta/66briG23oEf5WNRtuDZNmLIIjMOLE4XP:I4jIzuAIrgfBEoSWYDjmUIjMe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
836	Fedex Invoice-XXXXX4210-02032023073135894221.exe
836	Fedex Invoice-XXXXX4210-02032023073135894221.exe
836	Fedex Invoice-XXXXX4210-02032023073135894221.exe
836	Fedex Invoice-XXXXX4210-02032023073135894221.exe
836	Fedex Invoice-XXXXX4210-02032023073135894221.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1288	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	28
PID 836 wrote to memory of 1288	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	28
PID 836 wrote to memory of 1288	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	28
PID 836 wrote to memory of 1288	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	28
PID 836 wrote to memory of 516	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	29
PID 836 wrote to memory of 516	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	29
PID 836 wrote to memory of 516	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	29
PID 836 wrote to memory of 516	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	29
PID 836 wrote to memory of 1912	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	30
PID 836 wrote to memory of 1912	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	30
PID 836 wrote to memory of 1912	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	30
PID 836 wrote to memory of 1912	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	30
PID 836 wrote to memory of 652	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	31
PID 836 wrote to memory of 652	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	31
PID 836 wrote to memory of 652	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	31
PID 836 wrote to memory of 652	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	31
PID 836 wrote to memory of 460	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	32
PID 836 wrote to memory of 460	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	32
PID 836 wrote to memory of 460	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	32
PID 836 wrote to memory of 460	836	Fedex Invoice-XXXXX4210-02032023073135894221.exe	32

C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
"C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
  "C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
  2⤵
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
  "C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
  2⤵
  PID:516
- C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
  "C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
  "C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe
  "C:\Users\Admin\AppData\Local\Temp\Fedex Invoice-XXXXX4210-02032023073135894221.exe"
  2⤵
  PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x00000000003F0000-0x00000000004AA000-memory.dmp

Download

memory/836-55-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Download

memory/836-56-0x0000000004290000-0x000000000434E000-memory.dmp

Download

memory/836-57-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Download

memory/836-58-0x00000000003C0000-0x00000000003D4000-memory.dmp

Download

memory/836-59-0x00000000003E0000-0x00000000003EC000-memory.dmp

Download

memory/836-60-0x0000000005F90000-0x000000000602A000-memory.dmp

Download

memory/836-61-0x00000000006E0000-0x0000000000702000-memory.dmp

Download