Analysis
- max time kernel
148s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
2020.07.06.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2020.07.06.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 2020.07.06.exe
- Size 575KB
- Sample200706-pamp32svcn
- SHA256 ca457dfbc65703fcbc3d124e7aac9933713f8788f2e04a92548ff95a23619139
- MD5 adaa6aa6c93e0c725b13c268442e1625
- SHA1 1d1c1aa6dfee7681d048fdcad0b1f05cd3dc8da0
- SHA512 a1579abef5044eecc8608ba6ae8d857056b1d8c45f12efa44833b293dde9ca1c774f5fcc4a2a187879ac666e38cad616862b37059d864a4e57f889218a2213f7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\msword = "\"C:\\Users\\Admin\\AppData\\Roaming\\msword.exe\"" 2020.07.06.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2920 wrote to memory of 3792 2920 2020.07.06.exe 67 PID 2992 wrote to memory of 3804 2992 Explorer.EXE 68 PID 2992 wrote to memory of 3804 2992 Explorer.EXE 68 PID 2992 wrote to memory of 3804 2992 Explorer.EXE 68 PID 3804 wrote to memory of 3784 3804 svchost.exe 69 PID 3804 wrote to memory of 3784 3804 svchost.exe 69 PID 3804 wrote to memory of 3784 3804 svchost.exe 69 PID 3804 wrote to memory of 644 3804 svchost.exe 77 PID 3804 wrote to memory of 644 3804 svchost.exe 77 PID 3804 wrote to memory of 644 3804 svchost.exe 77 - Executes dropped EXE 1 IoCs
pid Process 3792 2020.07.06.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3792 2020.07.06.exe 3792 2020.07.06.exe 3792 2020.07.06.exe 3804 svchost.exe 3804 svchost.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ln6qlxly\nbcpdxj0qfx0.exe svchost.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer svchost.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\NFSDKZI = "C:\\Program Files (x86)\\Ln6qlxly\\nbcpdxj0qfx0.exe" svchost.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2920 2020.07.06.exe Token: SeDebugPrivilege 3792 2020.07.06.exe Token: SeDebugPrivilege 3804 svchost.exe Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 75 IoCs
pid Process 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 2920 2020.07.06.exe 3792 2020.07.06.exe 3792 2020.07.06.exe 3792 2020.07.06.exe 3792 2020.07.06.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe 3804 svchost.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2920 set thread context of 3792 2920 2020.07.06.exe 67 PID 3792 set thread context of 2992 3792 2020.07.06.exe 56 PID 3804 set thread context of 2992 3804 svchost.exe 56 -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2020.07.06.exe"C:\Users\Admin\AppData\Local\Temp\2020.07.06.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2020.07.06.exe"C:\Users\Admin\AppData\Local\Temp\2020.07.06.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3792
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- System policy modification
- Adds Run entry to policy start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
PID:3804 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2020.07.06.exe"3⤵PID:3784
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:644
-
-