3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8

General

Target
PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
Size 734KB
Sample200707-7zffaybde2
SHA256 3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8
MD5 959e9da7ae625d201502726f42287a6a
SHA1 d4c6f0d7b6a32966e183ee6cab7a8b92e7e443dd
SHA512 76bc600029c412b55dbfb2de01e1972927c826f460916b410a4e99ae3713acc02c1dd801a1ae2d35a8548b09c951388a6758fc42790dde43ea4cd79f4b7c4ebc
MD5 SHA1 SHA512

Score

10^/10

spyware

Credentials

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3796	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	67
PID 3028 wrote to memory of 3796	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	67
PID 3028 wrote to memory of 3796	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	67
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3028 wrote to memory of 3748	3028	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	69
PID 3748 wrote to memory of 3240	3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	77
PID 3748 wrote to memory of 3240	3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	77
PID 3748 wrote to memory of 3240	3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe	77

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
3748	PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3796	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3240	REG.exe

C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yWQlEWNNbEmrQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F5C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:3240