Analysis
- max time kernel
92s - max time network
96s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order (#16062020).exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Purchase Order (#16062020).exe
- Size 464KB
- Sample200624-zs8chbearx
- SHA256 7ef7ff0660d406b237fd3253738d60a294c0273ca1436cf9ba87d5b2ea8d62d8
- MD5 9fbf3d861158629cfd1c65cf8425c8b6
- SHA1 b9ac6bdaed6db2a4c62754b897a625f9b6efa188
- SHA512 f8810d51c4673c3dee8209e5e4df0a3d482ef51b15d5d5a2d0bc8a4d264865306803a37b7a741f27595a361763b352bab370d1af26f2d1005ac3cd242ebd8496
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3812 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3952 cmd.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 3952 cmd.exe Token: SeRestorePrivilege 3952 cmd.exe Token: SeBackupPrivilege 3952 cmd.exe Token: SeLoadDriverPrivilege 3952 cmd.exe Token: SeCreatePagefilePrivilege 3952 cmd.exe Token: SeShutdownPrivilege 3952 cmd.exe Token: SeTakeOwnershipPrivilege 3952 cmd.exe Token: SeChangeNotifyPrivilege 3952 cmd.exe Token: SeCreateTokenPrivilege 3952 cmd.exe Token: SeMachineAccountPrivilege 3952 cmd.exe Token: SeSecurityPrivilege 3952 cmd.exe Token: SeAssignPrimaryTokenPrivilege 3952 cmd.exe Token: SeCreateGlobalPrivilege 3952 cmd.exe Token: 33 3952 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cmd.exe - Suspicious use of WriteProcessMemory 105 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3812 3020 Purchase Order (#16062020).exe 67 PID 3020 wrote to memory of 3812 3020 Purchase Order (#16062020).exe 67 PID 3020 wrote to memory of 3812 3020 Purchase Order (#16062020).exe 67 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 PID 3812 wrote to memory of 3952 3812 rundll32.exe 70 - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3812 rundll32.exe 3812 rundll32.exe 3812 rundll32.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3812 rundll32.exe 3812 rundll32.exe 3812 rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order (#16062020).exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order (#16062020).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe ProfilePricket,Pretor2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3928
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Checks processor information in registry
- Checks whether UAC is enabled
PID:3952
-
-