Analysis
-
max time kernel
111s -
max time network
155s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
14-03-2020 00:56
Static task
static1
Behavioral task
behavioral1
Sample
#0034004 SHIPPING ITEMS LISTED pdf.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
#0034004 SHIPPING ITEMS LISTED pdf.exe
Resource
win10v200217
General
-
Target
#0034004 SHIPPING ITEMS LISTED pdf.exe
-
Size
1.1MB
-
MD5
909fc4fc06c72165829eb0dc45ec6fa2
-
SHA1
87673992368f3db1a973c1d1f04bd11eecbf8470
-
SHA256
ffe06faf3552c18f24916d1068805503c668c7cc34e9fd90266d04571c6ad94a
-
SHA512
336ca81a032fa11c992cc25bd74b269b14ec092e2fa23df9d534006ec19441bde8862a3789782fd7121c3a43a8dd3ee5fc76654de6cba8d1d7847ec940fff8cb
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exe#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process target process PID 3836 set thread context of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3760 set thread context of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 set thread context of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exevbc.exepid process 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe 3656 vbc.exe 3656 vbc.exe 3656 vbc.exe 3656 vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 bot.whatismyipaddress.com -
Uses the VBS compiler for execution 1 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exe#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process target process PID 3836 wrote to memory of 3088 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 3836 wrote to memory of 3088 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 3836 wrote to memory of 3088 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe schtasks.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3836 wrote to memory of 3760 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe #0034004 SHIPPING ITEMS LISTED pdf.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3656 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe PID 3760 wrote to memory of 3284 3760 #0034004 SHIPPING ITEMS LISTED pdf.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
#0034004 SHIPPING ITEMS LISTED pdf.exedescription pid process Token: SeDebugPrivilege 3836 #0034004 SHIPPING ITEMS LISTED pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
Processes
-
C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3836 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QqwpPdxUAvuHEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB19C.tmp"2⤵
- Creates scheduled task(s)
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\#0034004 SHIPPING ITEMS LISTED pdf.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp46F.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpCDD.tmp"3⤵PID:3284