Analysis
-
max time kernel
128s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 17:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order and Sample Drawings.exe
Resource
win7
Behavioral task
behavioral2
Sample
Purchase Order and Sample Drawings.exe
Resource
win10v200430
General
-
Target
Purchase Order and Sample Drawings.exe
-
Size
821KB
-
MD5
3b366485eba8147bf73fc3020d09c947
-
SHA1
8ddbf9383d58c23a93ec8a24ec77a432ec3d63ac
-
SHA256
fe7dc35391c88f2001b6637186c2fa677bb5f1a08cfdafcfc95a1e1fc2f026a9
-
SHA512
b65af6b653626d15208ac66207b44c045b2869ce3c1a1f8214a128e0e204507fc4ab2aa3b3ec288f197cd3081eb4f9ae4eabdf870c2d5980457a559e6bcdf04c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
$wz$images.exepid process 3024 $wz$images.exe -
Loads dropped DLL 4 IoCs
Processes:
$wz$images.exepid process 3024 $wz$images.exe 3024 $wz$images.exe 3024 $wz$images.exe 3024 $wz$images.exe -
Drops startup file 2 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat Purchase Order and Sample Drawings.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start Purchase Order and Sample Drawings.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
WerFault.exeWerFault.exepid process 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 3384 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe -
NTFS ADS 1 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process File created C:\ProgramData:ApplicationData Purchase Order and Sample Drawings.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Purchase Order and Sample Drawings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\$wz$Images = "C:\\ProgramData\\$wz$images.exe" Purchase Order and Sample Drawings.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Purchase Order and Sample Drawings.exe$wz$images.exedescription pid process target process PID 1484 wrote to memory of 2752 1484 Purchase Order and Sample Drawings.exe powershell.exe PID 1484 wrote to memory of 2752 1484 Purchase Order and Sample Drawings.exe powershell.exe PID 1484 wrote to memory of 2752 1484 Purchase Order and Sample Drawings.exe powershell.exe PID 1484 wrote to memory of 3024 1484 Purchase Order and Sample Drawings.exe $wz$images.exe PID 1484 wrote to memory of 3024 1484 Purchase Order and Sample Drawings.exe $wz$images.exe PID 1484 wrote to memory of 3024 1484 Purchase Order and Sample Drawings.exe $wz$images.exe PID 3024 wrote to memory of 380 3024 $wz$images.exe powershell.exe PID 3024 wrote to memory of 380 3024 $wz$images.exe powershell.exe PID 3024 wrote to memory of 380 3024 $wz$images.exe powershell.exe PID 3024 wrote to memory of 3904 3024 $wz$images.exe cmd.exe PID 3024 wrote to memory of 3904 3024 $wz$images.exe cmd.exe PID 3024 wrote to memory of 3904 3024 $wz$images.exe cmd.exe PID 3024 wrote to memory of 3904 3024 $wz$images.exe cmd.exe PID 3024 wrote to memory of 3904 3024 $wz$images.exe cmd.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3384 2752 WerFault.exe powershell.exe 1668 380 WerFault.exe powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3384 WerFault.exe Token: SeBackupPrivilege 3384 WerFault.exe Token: SeDebugPrivilege 3384 WerFault.exe Token: SeDebugPrivilege 1668 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order and Sample Drawings.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order and Sample Drawings.exe"1⤵
- Drops startup file
- NTFS ADS
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 7043⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\$wz$images.exe"C:\ProgramData\$wz$images.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 7004⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\$wz$images.exe
-
C:\ProgramData\$wz$images.exe
-
\Users\Admin\AppData\Local\Temp\freebl3.dll
-
\Users\Admin\AppData\Local\Temp\freebl3.dll
-
\Users\Admin\AppData\Local\Temp\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\msvcp140.dll
-
memory/380-60-0x0000000000000000-mapping.dmp
-
memory/380-51-0x0000000000000000-mapping.dmp
-
memory/380-61-0x0000000000000000-mapping.dmp
-
memory/380-59-0x0000000000000000-mapping.dmp
-
memory/380-58-0x0000000000000000-mapping.dmp
-
memory/380-57-0x0000000000000000-mapping.dmp
-
memory/1484-0-0x0000000001E90000-0x0000000001FE4000-memory.dmpFilesize
1.3MB
-
memory/1668-54-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/1668-56-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/1668-62-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1668-53-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/2752-9-0x0000000000000000-mapping.dmp
-
memory/2752-6-0x0000000000000000-mapping.dmp
-
memory/2752-11-0x0000000000000000-mapping.dmp
-
memory/2752-10-0x0000000000000000-mapping.dmp
-
memory/2752-8-0x0000000000000000-mapping.dmp
-
memory/2752-7-0x0000000000000000-mapping.dmp
-
memory/2752-1-0x0000000000000000-mapping.dmp
-
memory/3024-50-0x0000000001290000-0x00000000013E4000-memory.dmpFilesize
1.3MB
-
memory/3024-2-0x0000000000000000-mapping.dmp
-
memory/3384-13-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/3384-5-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/3904-52-0x0000000000000000-mapping.dmp
-
memory/3904-63-0x0000000000000000-mapping.dmp