Analysis
- max time kernel
148s - max time network
142s - platform
windows10_x64 - resource
win10v200430 - submitted
29/06/2020, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
order_pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order_pdf.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target order_pdf.exe
- Size 910KB
- Sample200629-ta4v3fdyva
- SHA256 c177f9b4bd74ab895e5b56bd2de176fa8eef55435f62a734fabc4a1215980c60
- MD5 d38e9c39faac975c30bd2fb2020ba43c
- SHA1 7d262fc3352fea32ec3c7f66297b4f1998b5f062
- SHA512 35799a6a2b28224f7a3afbef8604db5aba9041c6f3d2425edf6d594a85c22780825ff0228bf9d37375c519aea2d0e6bf9bd4158eea4e7b6921317521fe34b8cf
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2156 ieinstal.exe 2156 ieinstal.exe 2156 ieinstal.exe 2156 ieinstal.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hjdk = "C:\\Users\\Admin\\AppData\\Local\\Hjdk\\Hjdk.hta" order_pdf.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 724 wrote to memory of 2156 724 order_pdf.exe 69 PID 724 wrote to memory of 2156 724 order_pdf.exe 69 PID 724 wrote to memory of 2156 724 order_pdf.exe 69 PID 724 wrote to memory of 2156 724 order_pdf.exe 69 PID 724 wrote to memory of 2156 724 order_pdf.exe 69 PID 2984 wrote to memory of 2784 2984 Explorer.EXE 72 PID 2984 wrote to memory of 2784 2984 Explorer.EXE 72 PID 2984 wrote to memory of 2784 2984 Explorer.EXE 72 PID 2784 wrote to memory of 3888 2784 help.exe 73 PID 2784 wrote to memory of 3888 2784 help.exe 73 PID 2784 wrote to memory of 3888 2784 help.exe 73 PID 2784 wrote to memory of 3352 2784 help.exe 76 PID 2784 wrote to memory of 3352 2784 help.exe 76 PID 2784 wrote to memory of 3352 2784 help.exe 76 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 724 set thread context of 2156 724 order_pdf.exe 69 PID 2156 set thread context of 2984 2156 ieinstal.exe 56 PID 2784 set thread context of 2984 2784 help.exe 56 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2156 ieinstal.exe Token: SeDebugPrivilege 2784 help.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2156 ieinstal.exe 2156 ieinstal.exe 2156 ieinstal.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\order_pdf.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:724 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2156
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2784 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3888
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3352
-
-