Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Shipping documentsInvoice and Packing List, Certificate of Origin.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shipping documentsInvoice and Packing List, Certificate of Origin.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target Shipping documentsInvoice and Packing List, Certificate of Origin.exe
- Size 20.0MB
- Sample260814-cc4ysaef49
- SHA256 92afed2da49310523d57cc94493d86b77e405db2fbc14a8e2bbfec0285db0f59
- MD5 f6dfc69247a86e1a73948d15ba2b7b1c
- SHA1 cda42818a9bcbd0b32b2214baa4e077f65583f84
- SHA512 24bdbe98e012eb9c4b0e176494dfd7b0bc7b9aa3eefcb24b2d179a687a6509b5e06d64bba8cabbdcc652e5636f95713910f1477ef54a889b021dbe06cfb85ab0
- SSDEEP 196608:DrBXt5LXCuz9eL5FUtX48nvhbTWxszARpdBMKSrXegGW9nsAy:nFt5LXCuz9eL5FUtX48nvoaEstnsAy
- TLSH T18227290567F98194F1F797349AB28787DA76BC416B34C68F0250620E1E73AE0DE7A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe 2052 Shipping documentsInvoice and Packing List, Certificate of Origin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List, Certificate of Origin.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List, Certificate of Origin.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2052