Analysis
- max time kernel
145s - max time network
69s - platform
windows10_x64 - resource
win10v200430 - submitted
03/07/2020, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER 4093021.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PURCHASE ORDER 4093021.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target PURCHASE ORDER 4093021.exe
- Size 366KB
- Sample200703-hmccc28atj
- SHA256 165a08681451ecc7ad583d97bacbc449b219a7ea3daa0355f2c77d19907a1d0d
- MD5 9c31b792ade0143cf3ed165b3358ba5c
- SHA1 ad0484380e1acd9601c7366020951aab8cafc35c
- SHA512 598db3736db0591c3c6d0a476ac8baa40d23d9fa1f428b8090f2b0ad272f8a21fc06e841e04eee782ab22f48b28c3d66a6befe93d2c28b4f330dc41da4c9ebc9
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2636 2916 PURCHASE ORDER 4093021.exe 72 PID 2916 wrote to memory of 2636 2916 PURCHASE ORDER 4093021.exe 72 PID 2916 wrote to memory of 2636 2916 PURCHASE ORDER 4093021.exe 72 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2916 wrote to memory of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2988 wrote to memory of 2768 2988 Explorer.EXE 74 PID 2988 wrote to memory of 2768 2988 Explorer.EXE 74 PID 2988 wrote to memory of 2768 2988 Explorer.EXE 74 PID 2768 wrote to memory of 3004 2768 help.exe 75 PID 2768 wrote to memory of 3004 2768 help.exe 75 PID 2768 wrote to memory of 3004 2768 help.exe 75 - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2916 PURCHASE ORDER 4093021.exe Token: SeDebugPrivilege 2708 PURCHASE ORDER 4093021.exe Token: SeDebugPrivilege 2768 help.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2916 PURCHASE ORDER 4093021.exe 2916 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe 2768 help.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2916 set thread context of 2708 2916 PURCHASE ORDER 4093021.exe 73 PID 2708 set thread context of 2988 2708 PURCHASE ORDER 4093021.exe 56 PID 2768 set thread context of 2988 2768 help.exe 56 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2708 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2708 PURCHASE ORDER 4093021.exe 2768 help.exe 2768 help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 4093021.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 4093021.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 4093021.exe"{path}"3⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 4093021.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2708
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2768 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 4093021.exe"3⤵PID:3004
-
-