Analysis
-
max time kernel
157s -
max time network
114s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
14-03-2020 00:56
Static task
static1
Behavioral task
behavioral1
Sample
#0034004 SHIPPING ITEMS LISTED pdf.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
#0034004 SHIPPING ITEMS LISTED pdf.exe
Resource
win10v200217
General
-
Target
#0034004 SHIPPING ITEMS LISTED pdf.exe
-
Size
1.1MB
-
MD5
909fc4fc06c72165829eb0dc45ec6fa2
-
SHA1
87673992368f3db1a973c1d1f04bd11eecbf8470
-
SHA256
ffe06faf3552c18f24916d1068805503c668c7cc34e9fd90266d04571c6ad94a
-
SHA512
336ca81a032fa11c992cc25bd74b269b14ec092e2fa23df9d534006ec19441bde8862a3789782fd7121c3a43a8dd3ee5fc76654de6cba8d1d7847ec940fff8cb
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process Token: SeDebugPrivilege 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exevbc.exepid process 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe 1288 vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
-
Uses the VBS compiler for execution 1 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exe#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process target process PID 1868 wrote to memory of 1932 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 1868 wrote to memory of 1932 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 1868 wrote to memory of 1932 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 1868 wrote to memory of 1932 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1868 wrote to memory of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 wrote to memory of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exe#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process target process PID 1868 set thread context of 1964 1868 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 1964 set thread context of 1288 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 1964 set thread context of 1632 1964 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1868 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QqwpPdxUAvuHEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C9B.tmp"2⤵
- Creates scheduled task(s)
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7271.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp644E.tmp"3⤵PID:1632