Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
03-03-2020 00:46
Static task
static1
Behavioral task
behavioral1
Sample
REVISED PURCHASE ORDER #00146 pdf.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
REVISED PURCHASE ORDER #00146 pdf.exe
Resource
win10v200217
General
-
Target
REVISED PURCHASE ORDER #00146 pdf.exe
-
Size
1.1MB
-
MD5
f02cce9c5ca0f7d9fa7e5e680f517399
-
SHA1
8efa6b644c053e37204c3ad1fe2cb55fec3c264b
-
SHA256
dfba8d6508a5b6ff77d41785718e4dfe524b968eed5d8db0676804b06c412756
-
SHA512
7e30e3dc6de142f07fd2d205360dbc8c1e142ddce6800ab4212207bc31d849302edb40f97c029257534a03f32248d9b0e4b08015b991a9f8fd5e00e13003bc56
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Reads browser user data or profiles (possible credential harvesting) 2 TTPs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
REVISED PURCHASE ORDER #00146 pdf.exeREVISED PURCHASE ORDER #00146 pdf.exedescription pid process target process PID 1840 wrote to memory of 1876 1840 REVISED PURCHASE ORDER #00146 pdf.exe schtasks.exe PID 1840 wrote to memory of 1876 1840 REVISED PURCHASE ORDER #00146 pdf.exe schtasks.exe PID 1840 wrote to memory of 1876 1840 REVISED PURCHASE ORDER #00146 pdf.exe schtasks.exe PID 1840 wrote to memory of 1876 1840 REVISED PURCHASE ORDER #00146 pdf.exe schtasks.exe PID 1840 wrote to memory of 1920 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1920 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1920 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1920 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1840 wrote to memory of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 wrote to memory of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
REVISED PURCHASE ORDER #00146 pdf.exedescription pid process Token: SeDebugPrivilege 1840 REVISED PURCHASE ORDER #00146 pdf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
REVISED PURCHASE ORDER #00146 pdf.exevbc.exepid process 1840 REVISED PURCHASE ORDER #00146 pdf.exe 1840 REVISED PURCHASE ORDER #00146 pdf.exe 856 vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED PURCHASE ORDER #00146 pdf.exeREVISED PURCHASE ORDER #00146 pdf.exedescription pid process target process PID 1840 set thread context of 1928 1840 REVISED PURCHASE ORDER #00146 pdf.exe REVISED PURCHASE ORDER #00146 pdf.exe PID 1928 set thread context of 856 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe PID 1928 set thread context of 344 1928 REVISED PURCHASE ORDER #00146 pdf.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER #00146 pdf.exe"C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER #00146 pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1840 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wVtEKkaHL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F5A.tmp"2⤵
- Creates scheduled task(s)
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER #00146 pdf.exe"{path}"2⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER #00146 pdf.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1928 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD3B2.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:856 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC5AF.tmp"3⤵PID:344