Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
02/07/2020, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
list of our order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
list of our order.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target list of our order.exe
- Size 758KB
- Sample200702-p38yxdef6a
- SHA256 de129b85c2c4cd0e7d1817d2a8b3095d02ef8880f6273c88c0ff3cd48a9a9dd8
- MD5 b4d96c55f676d81285ae41fb7eb0b20e
- SHA1 e26c244376810763f5e3e6e3dd5aca4da287fd93
- SHA512 9ca1076af9efb59fd7a12a0f52122cf13e7eb220b2f567e21c6053547d494b826be644597f1680275a660acd6fb053784f6cb3e3bfc80cd847ce33da127eb828
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\U2ALHPZH3B = "C:\\Program Files (x86)\\Zqpwlwh\\stzpilxpjz7phb.exe" cmd.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2304 2964 Explorer.EXE 66 PID 2964 wrote to memory of 2304 2964 Explorer.EXE 66 PID 2964 wrote to memory of 2304 2964 Explorer.EXE 66 PID 2304 wrote to memory of 3596 2304 cmd.exe 67 PID 2304 wrote to memory of 3596 2304 cmd.exe 67 PID 2304 wrote to memory of 3596 2304 cmd.exe 67 PID 2304 wrote to memory of 3744 2304 cmd.exe 75 PID 2304 wrote to memory of 3744 2304 cmd.exe 75 PID 2304 wrote to memory of 3744 2304 cmd.exe 75 PID 2304 wrote to memory of 644 2304 cmd.exe 77 PID 2304 wrote to memory of 644 2304 cmd.exe 77 PID 2304 wrote to memory of 644 2304 cmd.exe 77 - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2964 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2964 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Zqpwlwh\stzpilxpjz7phb.exe cmd.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmd.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 792 list of our order.exe 792 list of our order.exe 792 list of our order.exe 792 list of our order.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 792 list of our order.exe Token: SeDebugPrivilege 2304 cmd.exe Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 792 list of our order.exe 792 list of our order.exe 792 list of our order.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe 2304 cmd.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 792 set thread context of 2964 792 list of our order.exe 56 PID 2304 set thread context of 2964 2304 cmd.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\list of our order.exe"C:\Users\Admin\AppData\Local\Temp\list of our order.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- System policy modification
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2304 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\list of our order.exe"3⤵PID:3596
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3744
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:644
-
-