Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
30-06-2020 05:23
Static task
static1
Behavioral task
behavioral1
Sample
PO389732.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO389732.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
PO389732.exe
-
Size
325KB
-
MD5
4cd3bc98fa3df22248c7e5d63dbe1168
-
SHA1
fb32e85f940945c6c0d3052b80f48f5bc48f7c7d
-
SHA256
cde5b9157162c55139f508884d7be6be903acc9d85842a667c1b2ef04a1ecd49
-
SHA512
0b2d2ada876da8ae777b80f2b99895b62449052e723ef5c6a71d02c317dc6c34346f1a35ea875149f2ebd94b775a7b8e3f2e712e2765e0e2fe82c2ec7376896e
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PO389732.exeExplorer.EXEsvchost.exedescription pid process target process PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1528 wrote to memory of 1860 1528 PO389732.exe PO389732.exe PID 1316 wrote to memory of 1872 1316 Explorer.EXE svchost.exe PID 1316 wrote to memory of 1872 1316 Explorer.EXE svchost.exe PID 1316 wrote to memory of 1872 1316 Explorer.EXE svchost.exe PID 1316 wrote to memory of 1872 1316 Explorer.EXE svchost.exe PID 1872 wrote to memory of 1772 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1772 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1772 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1772 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1732 1872 svchost.exe Firefox.exe PID 1872 wrote to memory of 1732 1872 svchost.exe Firefox.exe PID 1872 wrote to memory of 1732 1872 svchost.exe Firefox.exe PID 1872 wrote to memory of 1732 1872 svchost.exe Firefox.exe PID 1872 wrote to memory of 1732 1872 svchost.exe Firefox.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System policy modification 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files (x86)\Mpnup\gdiox4ddxuh.exe svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO389732.exePO389732.exesvchost.exedescription pid process target process PID 1528 set thread context of 1860 1528 PO389732.exe PO389732.exe PID 1860 set thread context of 1316 1860 PO389732.exe Explorer.EXE PID 1860 set thread context of 1316 1860 PO389732.exe Explorer.EXE PID 1872 set thread context of 1316 1872 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
PO389732.exesvchost.exepid process 1860 PO389732.exe 1860 PO389732.exe 1860 PO389732.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
PO389732.exesvchost.exepid process 1860 PO389732.exe 1860 PO389732.exe 1860 PO389732.exe 1860 PO389732.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe 1872 svchost.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1772 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO389732.exesvchost.exedescription pid process Token: SeDebugPrivilege 1860 PO389732.exe Token: SeDebugPrivilege 1872 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XJKDUFP8DN = "C:\\Program Files (x86)\\Mpnup\\gdiox4ddxuh.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\PO389732.exe"C:\Users\Admin\AppData\Local\Temp\PO389732.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\PO389732.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
- System policy modification
- Drops file in Program Files directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO389732.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1316-4-0x00000000069E0000-0x0000000006B3D000-memory.dmpFilesize
1.4MB
-
memory/1528-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1732-10-0x0000000000000000-mapping.dmp
-
memory/1732-11-0x000000013F5F0000-0x000000013F683000-memory.dmpFilesize
588KB
-
memory/1772-7-0x0000000000000000-mapping.dmp
-
memory/1860-2-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1860-3-0x000000000041C160-mapping.dmp
-
memory/1872-5-0x0000000000000000-mapping.dmp
-
memory/1872-6-0x0000000000920000-0x0000000000928000-memory.dmpFilesize
32KB
-
memory/1872-8-0x0000000001A00000-0x0000000001B07000-memory.dmpFilesize
1.0MB
-
memory/1872-9-0x0000000003A30000-0x0000000003B59000-memory.dmpFilesize
1.2MB