Analysis
-
max time kernel
63s -
max time network
130s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 17:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order and Sample Drawings.exe
Resource
win7
Behavioral task
behavioral2
Sample
Purchase Order and Sample Drawings.exe
Resource
win10v200430
General
-
Target
Purchase Order and Sample Drawings.exe
-
Size
821KB
-
MD5
3b366485eba8147bf73fc3020d09c947
-
SHA1
8ddbf9383d58c23a93ec8a24ec77a432ec3d63ac
-
SHA256
fe7dc35391c88f2001b6637186c2fa677bb5f1a08cfdafcfc95a1e1fc2f026a9
-
SHA512
b65af6b653626d15208ac66207b44c045b2869ce3c1a1f8214a128e0e204507fc4ab2aa3b3ec288f197cd3081eb4f9ae4eabdf870c2d5980457a559e6bcdf04c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\$wz$Images = "C:\\ProgramData\\$wz$images.exe" Purchase Order and Sample Drawings.exe -
Loads dropped DLL 7 IoCs
Processes:
Purchase Order and Sample Drawings.exe$wz$images.exepid process 1088 Purchase Order and Sample Drawings.exe 316 $wz$images.exe 316 $wz$images.exe 316 $wz$images.exe 316 $wz$images.exe 316 $wz$images.exe 316 $wz$images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1400 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1400 powershell.exe 1400 powershell.exe 1044 powershell.exe 1044 powershell.exe -
NTFS ADS 1 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process File created C:\ProgramData:ApplicationData Purchase Order and Sample Drawings.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Purchase Order and Sample Drawings.exe$wz$images.exedescription pid process target process PID 1088 wrote to memory of 1400 1088 Purchase Order and Sample Drawings.exe powershell.exe PID 1088 wrote to memory of 1400 1088 Purchase Order and Sample Drawings.exe powershell.exe PID 1088 wrote to memory of 1400 1088 Purchase Order and Sample Drawings.exe powershell.exe PID 1088 wrote to memory of 1400 1088 Purchase Order and Sample Drawings.exe powershell.exe PID 1088 wrote to memory of 316 1088 Purchase Order and Sample Drawings.exe $wz$images.exe PID 1088 wrote to memory of 316 1088 Purchase Order and Sample Drawings.exe $wz$images.exe PID 1088 wrote to memory of 316 1088 Purchase Order and Sample Drawings.exe $wz$images.exe PID 1088 wrote to memory of 316 1088 Purchase Order and Sample Drawings.exe $wz$images.exe PID 316 wrote to memory of 1044 316 $wz$images.exe powershell.exe PID 316 wrote to memory of 1044 316 $wz$images.exe powershell.exe PID 316 wrote to memory of 1044 316 $wz$images.exe powershell.exe PID 316 wrote to memory of 1044 316 $wz$images.exe powershell.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe PID 316 wrote to memory of 1516 316 $wz$images.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
$wz$images.exepid process 316 $wz$images.exe -
Drops startup file 2 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat Purchase Order and Sample Drawings.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start Purchase Order and Sample Drawings.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order and Sample Drawings.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order and Sample Drawings.exe"1⤵
- Adds Run entry to start application
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
- Drops startup file
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\$wz$images.exe"C:\ProgramData\$wz$images.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData
-
C:\ProgramData\$wz$images.exe
-
C:\ProgramData\$wz$images.exe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_430e86e2-27ff-40b1-af5f-f628ef5ff218
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d4f2ad2-af9e-41f5-b820-70b3e5025202
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b512d2ad-08b7-4bc4-89b3-79067c706957
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ce98e9e0-7c63-489b-a4bc-d529940c572f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
\ProgramData\$wz$images.exe
-
\Users\Admin\AppData\Local\Temp\freebl3.dll
-
\Users\Admin\AppData\Local\Temp\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\nss3.dll
-
\Users\Admin\AppData\Local\Temp\softokn3.dll
-
\Users\Admin\AppData\Local\Temp\vcruntime140.dll
-
memory/316-8-0x0000000001380000-0x00000000014D4000-memory.dmpFilesize
1.3MB
-
memory/316-3-0x0000000000000000-mapping.dmp
-
memory/1044-10-0x0000000000000000-mapping.dmp
-
memory/1088-0-0x0000000000510000-0x0000000000664000-memory.dmpFilesize
1.3MB
-
memory/1400-1-0x0000000000000000-mapping.dmp
-
memory/1516-11-0x0000000000000000-mapping.dmp
-
memory/1516-15-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1516-16-0x0000000000000000-mapping.dmp