242fd0dd3bdb82528717b002fecd9840fd250ffddbe5926832fb200b39d7c933

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-07-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TNT Shipping Documents.exe
Size

64KB
MD5

0fa0517e3da3d0e14ca73aa140573a37
SHA1

90b0c522ef09a57c9ba31a95db898115a810a0c2
SHA256

5a4f747f9f958dade617f220d9cc236f53f31f1627e758a399c5ad30fd7eeda3
SHA512

f5cc076c0402153396828cc996b59e5cb192de21d052c71b332902ea33ffbbb60a58a057cff236be9fd2a0453463ed4e8a9e901129be2bb93010c5e7bd784517
SSDEEP

1536:bJY/ssWIoJ8sGFz7dmPzc818U0Q8z/g5:vIoJ5GFHuzs/g5

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3032	TNT Shipping Documents.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe
3032	TNT Shipping Documents.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	TNT Shipping Documents.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2092	3032	TNT Shipping Documents.exe	31
PID 3032 wrote to memory of 2092	3032	TNT Shipping Documents.exe	31
PID 3032 wrote to memory of 2092	3032	TNT Shipping Documents.exe	31
PID 3032 wrote to memory of 2092	3032	TNT Shipping Documents.exe	31
PID 3032 wrote to memory of 620	3032	TNT Shipping Documents.exe	32
PID 3032 wrote to memory of 620	3032	TNT Shipping Documents.exe	32
PID 3032 wrote to memory of 620	3032	TNT Shipping Documents.exe	32
PID 3032 wrote to memory of 620	3032	TNT Shipping Documents.exe	32
PID 3032 wrote to memory of 2172	3032	TNT Shipping Documents.exe	33
PID 3032 wrote to memory of 2172	3032	TNT Shipping Documents.exe	33
PID 3032 wrote to memory of 2172	3032	TNT Shipping Documents.exe	33
PID 3032 wrote to memory of 2172	3032	TNT Shipping Documents.exe	33
PID 3032 wrote to memory of 2908	3032	TNT Shipping Documents.exe	34
PID 3032 wrote to memory of 2908	3032	TNT Shipping Documents.exe	34
PID 3032 wrote to memory of 2908	3032	TNT Shipping Documents.exe	34
PID 3032 wrote to memory of 2908	3032	TNT Shipping Documents.exe	34
PID 3032 wrote to memory of 2468	3032	TNT Shipping Documents.exe	35
PID 3032 wrote to memory of 2468	3032	TNT Shipping Documents.exe	35
PID 3032 wrote to memory of 2468	3032	TNT Shipping Documents.exe	35
PID 3032 wrote to memory of 2468	3032	TNT Shipping Documents.exe	35

C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000B40000-0x0000000000B54000-memory.dmp

Filesize
80KB

Download
memory/3032-2-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/3032-3-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/3032-4-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download