Analysis
- max time kernel
152s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
- submitted
01/11/2023, 13:09
General
- Target Shipping Documents 80053164992.exe
- Size 953KB
- Sample231101-qdr79sae53
- SHA256 f2ef4aecdf3304be6f7f7b729eea019ae8af63befc4c0736e71c722c169e3eab
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents 80053164992.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents 80053164992.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents 80053164992.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents 80053164992.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3732-0-0x0000000000AE0000-0x0000000000BD4000-memory.dmp
memory/3732-1-0x0000000074840000-0x0000000074FF0000-memory.dmp
memory/3732-2-0x0000000005BB0000-0x0000000006154000-memory.dmp
memory/3732-3-0x0000000005600000-0x0000000005692000-memory.dmp
memory/3732-4-0x0000000005740000-0x0000000005750000-memory.dmp
memory/3732-5-0x00000000055E0000-0x00000000055EA000-memory.dmp
memory/3732-6-0x0000000005750000-0x00000000057EC000-memory.dmp
memory/3732-7-0x0000000006960000-0x0000000006A14000-memory.dmp
memory/3732-8-0x0000000005B90000-0x0000000005BAA000-memory.dmp
memory/3732-9-0x0000000074840000-0x0000000074FF0000-memory.dmp
memory/3732-10-0x0000000005740000-0x0000000005750000-memory.dmp
memory/3732-11-0x0000000005740000-0x0000000005750000-memory.dmp