Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10v200430 - submitted
06/07/2020, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order ADFG-20200706.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase order ADFG-20200706.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Purchase order ADFG-20200706.exe
- Size 764KB
- Sample200706-3xdzybc3lx
- SHA256 d48571bc8422f8413510d8f59ab12afc84dff1c08f25e75240599d2b9a8a63fb
- MD5 2de71b90709956f9044e682697308551
- SHA1 2c70b12519f321afd011599114616adfb01c5421
- SHA512 ef8b2d8bc232142e877e149f5b370e9031b77a8f52c7d2fe5c08f59bba5c53419556412bde156a1f3e11ff6b75f0604c39a45aad3ca5d9d312a750f4d5ffbcfa
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Hljkx\3fohe_rwtjl.exe cscript.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 992 Purchase order ADFG-20200706.exe 992 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 992 wrote to memory of 1004 992 Purchase order ADFG-20200706.exe 67 PID 992 wrote to memory of 1004 992 Purchase order ADFG-20200706.exe 67 PID 992 wrote to memory of 1004 992 Purchase order ADFG-20200706.exe 67 PID 2996 wrote to memory of 3828 2996 Explorer.EXE 68 PID 2996 wrote to memory of 3828 2996 Explorer.EXE 68 PID 2996 wrote to memory of 3828 2996 Explorer.EXE 68 PID 3828 wrote to memory of 1860 3828 cscript.exe 71 PID 3828 wrote to memory of 1860 3828 cscript.exe 71 PID 3828 wrote to memory of 1860 3828 cscript.exe 71 PID 3828 wrote to memory of 4040 3828 cscript.exe 77 PID 3828 wrote to memory of 4040 3828 cscript.exe 77 PID 3828 wrote to memory of 4040 3828 cscript.exe 77 PID 3828 wrote to memory of 2976 3828 cscript.exe 79 PID 3828 wrote to memory of 2976 3828 cscript.exe 79 PID 3828 wrote to memory of 2976 3828 cscript.exe 79 - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 992 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 1004 Purchase order ADFG-20200706.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe 3828 cscript.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1004 Purchase order ADFG-20200706.exe Token: SeDebugPrivilege 3828 cscript.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 992 set thread context of 1004 992 Purchase order ADFG-20200706.exe 67 PID 1004 set thread context of 2996 1004 Purchase order ADFG-20200706.exe 56 PID 3828 set thread context of 2996 3828 cscript.exe 56 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\C0HL5TBPTBY = "C:\\Program Files (x86)\\Hljkx\\3fohe_rwtjl.exe" cscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\Purchase order ADFG-20200706.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order ADFG-20200706.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:992 -
C:\Users\Admin\AppData\Local\Temp\Purchase order ADFG-20200706.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order ADFG-20200706.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1004
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- System policy modification
- Adds Run entry to policy start application
PID:3828 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase order ADFG-20200706.exe"3⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:4040
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2976
-
-