Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 08:50
General
-
Target
Inquired Order JULY 07.exe
-
Size
647KB
-
MD5
d7c67c7b8828726f9162a31f13ae9384
-
SHA1
7a2e1b9d65f949f66b2636f706e8d5219b485af6
-
SHA256
a4ae57283aed9c08180d74dfadb082d76e10cb6f4b01a45d1145c60f651da100
-
SHA512
c100cc2455ae12dc4bbc000b4b79cf454060d9dc6591033d15c6e2b19a3370863a38f05c2c24c9b977a9dc53a8db24d3c3aa7dab5344cc59b4ded278b2d850a1
Score
7/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquired Order JULY 07.exe"C:\Users\Admin\AppData\Local\Temp\Inquired Order JULY 07.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquired Order JULY 07.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB