0116627fbc1a3a3f6516259816efa8919866cbef48ae91af49eeee7f6d35e661

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28-07-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TNT Shipping Documents.exe
Size

64KB
MD5

0fa0517e3da3d0e14ca73aa140573a37
SHA1

90b0c522ef09a57c9ba31a95db898115a810a0c2
SHA256

5a4f747f9f958dade617f220d9cc236f53f31f1627e758a399c5ad30fd7eeda3
SHA512

f5cc076c0402153396828cc996b59e5cb192de21d052c71b332902ea33ffbbb60a58a057cff236be9fd2a0453463ed4e8a9e901129be2bb93010c5e7bd784517
SSDEEP

1536:bJY/ssWIoJ8sGFz7dmPzc818U0Q8z/g5:vIoJ5GFHuzs/g5

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3040	TNT Shipping Documents.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe
3040	TNT Shipping Documents.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	TNT Shipping Documents.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2800	3040	TNT Shipping Documents.exe	30
PID 3040 wrote to memory of 2800	3040	TNT Shipping Documents.exe	30
PID 3040 wrote to memory of 2800	3040	TNT Shipping Documents.exe	30
PID 3040 wrote to memory of 2800	3040	TNT Shipping Documents.exe	30
PID 3040 wrote to memory of 2900	3040	TNT Shipping Documents.exe	31
PID 3040 wrote to memory of 2900	3040	TNT Shipping Documents.exe	31
PID 3040 wrote to memory of 2900	3040	TNT Shipping Documents.exe	31
PID 3040 wrote to memory of 2900	3040	TNT Shipping Documents.exe	31
PID 3040 wrote to memory of 2672	3040	TNT Shipping Documents.exe	32
PID 3040 wrote to memory of 2672	3040	TNT Shipping Documents.exe	32
PID 3040 wrote to memory of 2672	3040	TNT Shipping Documents.exe	32
PID 3040 wrote to memory of 2672	3040	TNT Shipping Documents.exe	32
PID 3040 wrote to memory of 2648	3040	TNT Shipping Documents.exe	33
PID 3040 wrote to memory of 2648	3040	TNT Shipping Documents.exe	33
PID 3040 wrote to memory of 2648	3040	TNT Shipping Documents.exe	33
PID 3040 wrote to memory of 2648	3040	TNT Shipping Documents.exe	33
PID 3040 wrote to memory of 2888	3040	TNT Shipping Documents.exe	34
PID 3040 wrote to memory of 2888	3040	TNT Shipping Documents.exe	34
PID 3040 wrote to memory of 2888	3040	TNT Shipping Documents.exe	34
PID 3040 wrote to memory of 2888	3040	TNT Shipping Documents.exe	34

C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x000007FEF5E83000-0x000007FEF5E84000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x0000000001050000-0x0000000001064000-memory.dmp

Filesize
80KB

Download
memory/3040-2-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

Filesize
9.9MB

Download
memory/3040-3-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/3040-4-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

Filesize
9.9MB

Download