Analysis
-
max time kernel
151s -
max time network
106s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
01-03-2020 13:59
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe
Resource
win10v200217
General
-
Target
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe
-
Size
905KB
-
MD5
5ef872eb756c58433cc665e5f64ccab7
-
SHA1
a6f485c33e5e782de687012a0cc64369b1c0ee79
-
SHA256
5d02ec68475acc04cf84886b20979f34a5432e0faf272bb5bcb79e7d041f5f91
-
SHA512
2af90214e7d58d8bb56c9d5d4fe950ce7bdaa95568139532e47eae5deabce5cc59a199d6af7b4dfef7a134b7e34e5c992018ad6f26e0764800a31cacf95f7276
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Reads browser user data or profiles (possible credential harvesting) 2 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exeNEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exedescription pid process target process PID 1840 wrote to memory of 1888 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe schtasks.exe PID 1840 wrote to memory of 1888 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe schtasks.exe PID 1840 wrote to memory of 1888 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe schtasks.exe PID 1840 wrote to memory of 1888 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe schtasks.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1840 wrote to memory of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 wrote to memory of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exeNEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exedescription pid process target process PID 1840 set thread context of 1932 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe PID 1932 set thread context of 1080 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe PID 1932 set thread context of 1476 1932 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exedescription pid process Token: SeDebugPrivilege 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exevbc.exepid process 1840 NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe 1080 vbc.exe -
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AELtkrxxvwV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA87.tmp"2⤵
- Creates scheduled task(s)
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER LISTED ITEMS HQ-61184 - AEM - SG pdf.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1932 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpEE25.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpE012.tmp"3⤵PID:1476