Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 05:48
General
-
Target
Shipping documentsInvoice and Packing List.exe
-
Size
1.1MB
-
MD5
a78784673b95a0368e80d0f56481b2c9
-
SHA1
d6c57ae123c5b98fa5e74c705ab2f0ebef60d859
-
SHA256
d1597a1081547fc01a3cac3d22c31b5cd21ae2ad3b95c4b2a0fa75e9e77d204a
-
SHA512
98df4367be9a9027062373e6f999971cf5d47c65be0348e0caf8fcceacd69702ac59bff7e61c55ed082edeafb929b7671022c8444618dc8ae6dc9613ae11cc23
-
SSDEEP
24576:S4lavt0LkLL9IMixoEgea55qGbjauDaq9MmCS:Fkwkn9IMHea5L61aPCS
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut4BED.tmpFilesize
262KB
MD5b3e8ad5bb2d6f05dba9e38094cc44f05
SHA1dc508fa1070fbc537dfc32bda0cddce6a4e9b540
SHA256bc96a7c9983b56f1e036fd2e88e488851048930436d8f08b4a1ae920ef6254ef
SHA512f638c1654cf91634cc5e41242d6c4d1b3f26a53dbfb47644920afab055579bfe03663eb9d83a42ef93817ffbfcc6ad315ca3134f992b9af9e63153681bc79b95
-
memory/4952-12-0x0000000003B10000-0x0000000003B14000-memory.dmpFilesize
16KB