3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8

General

Target
PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
Size 734KB
Sample200707-7zffaybde2
SHA256 3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8
MD5 959e9da7ae625d201502726f42287a6a
SHA1 d4c6f0d7b6a32966e183ee6cab7a8b92e7e443dd
SHA512 76bc600029c412b55dbfb2de01e1972927c826f460916b410a4e99ae3713acc02c1dd801a1ae2d35a8548b09c951388a6758fc42790dde43ea4cd79f4b7c4ebc
MD5 SHA1 SHA512

Score

7^/10

spyware

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
296	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1832	schtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1832	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	26
PID 1032 wrote to memory of 1832	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	26
PID 1032 wrote to memory of 1832	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	26
PID 1032 wrote to memory of 1832	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	26
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1032 wrote to memory of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28
PID 1880 wrote to memory of 296	1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	30
PID 1880 wrote to memory of 296	1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	30
PID 1880 wrote to memory of 296	1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	30
PID 1880 wrote to memory of 296	1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 1880	1032	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1032
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yWQlEWNNbEmrQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F6D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:296