Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 12:45
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order-77.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase order-77.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Purchase order-77.exe
-
Size
443KB
-
MD5
8a26d6812aece27f98e9985488d457b0
-
SHA1
ba317aa78c6efd8e763f7b7a19c858724c6f2f1d
-
SHA256
4fc6cac9d7547036158bc3aa8be06f2a6be57eabc406abf3a39c2cacb5f410b8
-
SHA512
bc94d03c06d842601f755073c8e47e3ae6f1b07aab30d347c3884c23ebf8e72acdb972f0b3a034ec5c31b49e76cd5a995d737e5e7f7497b52290019930608576
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1776 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase order-77.exePurchase order-77.exemstsc.exedescription pid process target process PID 1612 set thread context of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1532 set thread context of 1256 1532 Purchase order-77.exe Explorer.EXE PID 1532 set thread context of 1256 1532 Purchase order-77.exe Explorer.EXE PID 1316 set thread context of 1256 1316 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Purchase order-77.exemstsc.exepid process 1532 Purchase order-77.exe 1532 Purchase order-77.exe 1532 Purchase order-77.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe 1316 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase order-77.exemstsc.exedescription pid process Token: SeDebugPrivilege 1532 Purchase order-77.exe Token: SeDebugPrivilege 1316 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase order-77.exemstsc.exepid process 1532 Purchase order-77.exe 1532 Purchase order-77.exe 1532 Purchase order-77.exe 1532 Purchase order-77.exe 1316 mstsc.exe 1316 mstsc.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase order-77.exeExplorer.EXEmstsc.exedescription pid process target process PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1612 wrote to memory of 1532 1612 Purchase order-77.exe Purchase order-77.exe PID 1256 wrote to memory of 1316 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 1316 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 1316 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 1316 1256 Explorer.EXE mstsc.exe PID 1316 wrote to memory of 1776 1316 mstsc.exe cmd.exe PID 1316 wrote to memory of 1776 1316 mstsc.exe cmd.exe PID 1316 wrote to memory of 1776 1316 mstsc.exe cmd.exe PID 1316 wrote to memory of 1776 1316 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order-77.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order-77.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order-77.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase order-77.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-2-0x0000000004060000-0x000000000412E000-memory.dmpFilesize
824KB
-
memory/1316-3-0x0000000000000000-mapping.dmp
-
memory/1316-4-0x0000000000400000-0x0000000000504000-memory.dmpFilesize
1.0MB
-
memory/1316-6-0x0000000002010000-0x0000000002116000-memory.dmpFilesize
1.0MB
-
memory/1532-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1532-1-0x000000000041E300-mapping.dmp
-
memory/1776-5-0x0000000000000000-mapping.dmp