Analysis
- max time kernel
147s - max time network
143s - platform
windows10_x64 - resource
win10 - submitted
01/07/2020, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
REVISED NEW PURCHASE ORDER.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
REVISED NEW PURCHASE ORDER.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target REVISED NEW PURCHASE ORDER.exe
- Size 358KB
- Sample200701-qfwfbrjhds
- SHA256 086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4
- MD5 1b1c0c52aa4ea5794cce1dbce13ff573
- SHA1 2136d23ada2a3b0516232af52b099cdee57e24c8
- SHA512 cd1ddb4f9f63860c2e00033cc60cd97cc6556cabda1f6c34748787685fcae95efb8f107cfc95c01f0580263651ed58b5386e7d19427dc20380880f4ec4a73392
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 3064 rundll32.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mgfih\rlppuv1x.exe cscript.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LPXDQT20EHYP = "C:\\Program Files (x86)\\Mgfih\\rlppuv1x.exe" cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Suspicious use of WriteProcessMemory 94 IoCs
description pid Process procid_target PID 3100 wrote to memory of 3064 3100 REVISED NEW PURCHASE ORDER.exe 67 PID 3100 wrote to memory of 3064 3100 REVISED NEW PURCHASE ORDER.exe 67 PID 3100 wrote to memory of 3064 3100 REVISED NEW PURCHASE ORDER.exe 67 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3064 wrote to memory of 3312 3064 rundll32.exe 68 PID 3312 wrote to memory of 3956 3312 cmd.exe 72 PID 3312 wrote to memory of 3956 3312 cmd.exe 72 PID 3312 wrote to memory of 3956 3312 cmd.exe 72 PID 3956 wrote to memory of 3616 3956 cscript.exe 73 PID 3956 wrote to memory of 3616 3956 cscript.exe 73 PID 3956 wrote to memory of 3616 3956 cscript.exe 73 PID 3956 wrote to memory of 912 3956 cscript.exe 81 PID 3956 wrote to memory of 912 3956 cscript.exe 81 PID 3956 wrote to memory of 912 3956 cscript.exe 81 PID 3956 wrote to memory of 1300 3956 cscript.exe 83 PID 3956 wrote to memory of 1300 3956 cscript.exe 83 PID 3956 wrote to memory of 1300 3956 cscript.exe 83 - Loads dropped DLL 1 IoCs
pid Process 3064 rundll32.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3312 set thread context of 3020 3312 cmd.exe 56 PID 3312 set thread context of 3020 3312 cmd.exe 56 PID 3956 set thread context of 3020 3956 cscript.exe 56 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 3064 rundll32.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3312 cmd.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe 3956 cscript.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3312 cmd.exe Token: SeDebugPrivilege 3956 cscript.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\REVISED NEW PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED NEW PURCHASE ORDER.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe SkylabDewar,Hemlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:3064 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3312 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- System policy modification
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3956 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"6⤵PID:3616
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V6⤵PID:912
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"6⤵PID:1300
-
-
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3820
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3380
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3932
-