4d6f088f7ff7e10f5b6df7628f7641b15a90298f7dedc7b46291255c1aa89c23

General

Target

Shipment Arrival Notification of 772165397672.exe
Size

705KB
MD5

72db5e724a635395cdacbf78fac0475c
SHA1

edcb1c8960accc40d5becce4a74b1cc2d344007a
SHA256

4d6f088f7ff7e10f5b6df7628f7641b15a90298f7dedc7b46291255c1aa89c23
SHA512

d773c162058833d999ac889ecd4bb6c56552687d7e1d58ba81a4eecbd4936419494e636e8095fac5bdbfc284392fccec792092886b63afa9a96d066544f564a6
SSDEEP

12288:s1i8LkpEaPWJUl37gHxROu1uXT9CqAITASl99j6msd2UtHf+SpThKFc45/+qkR:TjE4I3HD1uXT9pAolP1sd/x+SpTUh/+p

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe
2624	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 1452 set thread context of 1192	1452	RegSvcs.exe	21
PID 1452 set thread context of 356	1452	RegSvcs.exe	37
PID 356 set thread context of 1192	356	iexpress.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2624	powershell.exe
2708	powershell.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
1452	RegSvcs.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe
356	iexpress.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1452	RegSvcs.exe
1192	Explorer.EXE
1192	Explorer.EXE
356	iexpress.exe
356	iexpress.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2708	2160	Shipment Arrival Notification of 772165397672.exe	28
PID 2160 wrote to memory of 2708	2160	Shipment Arrival Notification of 772165397672.exe	28
PID 2160 wrote to memory of 2708	2160	Shipment Arrival Notification of 772165397672.exe	28
PID 2160 wrote to memory of 2708	2160	Shipment Arrival Notification of 772165397672.exe	28
PID 2160 wrote to memory of 2624	2160	Shipment Arrival Notification of 772165397672.exe	30
PID 2160 wrote to memory of 2624	2160	Shipment Arrival Notification of 772165397672.exe	30
PID 2160 wrote to memory of 2624	2160	Shipment Arrival Notification of 772165397672.exe	30
PID 2160 wrote to memory of 2624	2160	Shipment Arrival Notification of 772165397672.exe	30
PID 2160 wrote to memory of 2388	2160	Shipment Arrival Notification of 772165397672.exe	32
PID 2160 wrote to memory of 2388	2160	Shipment Arrival Notification of 772165397672.exe	32
PID 2160 wrote to memory of 2388	2160	Shipment Arrival Notification of 772165397672.exe	32
PID 2160 wrote to memory of 2388	2160	Shipment Arrival Notification of 772165397672.exe	32
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 2160 wrote to memory of 1452	2160	Shipment Arrival Notification of 772165397672.exe	34
PID 1192 wrote to memory of 356	1192	Explorer.EXE	37
PID 1192 wrote to memory of 356	1192	Explorer.EXE	37
PID 1192 wrote to memory of 356	1192	Explorer.EXE	37
PID 1192 wrote to memory of 356	1192	Explorer.EXE	37

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Shipment Arrival Notification of 772165397672.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipment Arrival Notification of 772165397672.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipment Arrival Notification of 772165397672.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOcOzNsCFdZg.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOcOzNsCFdZg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC3AD.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1452
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\SysWOW64\iexpress.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC3AD.tmp

Filesize
1KB

MD5
4e1379829146f0e681e3cf9b53424e34

SHA1
66690db808a18dd872d74d2eea3f18e8a08f10da

SHA256
01eae7b9d1ae448200ec99f0747bf1c425d9679c4a83b93abc70de1a98f74efa

SHA512
60aa5a196db0b80d360a0d0ef5cfbc7ea0eaff09e4dc08f105eba56329b29a349222d415222bbe5875ec2d635e79cfaf711031e8e4af9d6eac6ad43fb3adf72d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3246718dc946c13409e33f9971501196

SHA1
0809aa5b2552831dbea14df3c180d022c8d43ac3

SHA256
7b851f2f80b5883b7082912757c05ee27ab569e6c06f2743e119722eaea63c89

SHA512
8e5a41abc079f6e78d5c915af07e2676a2724cb692bb3e0332ed3194186dba65c3bf6ceefcc4d1b5b78c4f17c51aa4d320e347056d8328cc8228f0cb47c5f3a8

Download Submit
memory/356-30-0x00000000000F0000-0x000000000012F000-memory.dmp

Filesize
252KB

Download
memory/356-29-0x00000000000F0000-0x000000000012F000-memory.dmp

Filesize
252KB

Download
memory/1192-28-0x0000000000220000-0x0000000000320000-memory.dmp

Filesize
1024KB

Download
memory/1452-20-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-25-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-27-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2160-4-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2160-6-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/2160-0-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/2160-26-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-5-0x0000000005440000-0x00000000054CA000-memory.dmp

Filesize
552KB

Download
memory/2160-7-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-3-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/2160-2-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-1-0x00000000001F0000-0x00000000002A2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads