Analysis
-
max time kernel
61s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 09:50
Static task
static1
Behavioral task
behavioral1
Sample
order details.EXCEL.XLSx.xls.exe
Resource
win7
0 signatures
0 seconds
General
-
Target
order details.EXCEL.XLSx.xls.exe
-
Size
343KB
-
MD5
1da38d8120af8bb60bc424739c1803fd
-
SHA1
3025d7f236bd898cdc0843bc1bf6e03c1fe84d46
-
SHA256
964e7b311e933799477fd793aa4e7721af35fe5c494fd9d995a6a620b162e516
-
SHA512
176c83941647410706f1871049940fe9e5a7b3f03e04ba20ed4bf3d01e601d79420f5d7c52d6cf8484f985a55550109559efa97152df82f462cd7477fa04cb04
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
order details.EXCEL.XLSx.xls.exedescription pid process target process PID 1088 set thread context of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
order details.EXCEL.XLSx.xls.exedescription pid process Token: SeImpersonatePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeTcbPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeChangeNotifyPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeCreateTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeBackupPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeRestorePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeIncreaseQuotaPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeAssignPrimaryTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeImpersonatePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeTcbPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeChangeNotifyPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeCreateTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeBackupPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeRestorePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeIncreaseQuotaPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeAssignPrimaryTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeImpersonatePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeTcbPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeChangeNotifyPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeCreateTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeBackupPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeRestorePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeIncreaseQuotaPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeAssignPrimaryTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeImpersonatePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeTcbPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeChangeNotifyPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeCreateTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeBackupPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeRestorePrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeIncreaseQuotaPrivilege 1408 order details.EXCEL.XLSx.xls.exe Token: SeAssignPrimaryTokenPrivilege 1408 order details.EXCEL.XLSx.xls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1040 cmd.exe -
Checks for installed software on the system 1 TTPs 10 IoCs
Processes:
order details.EXCEL.XLSx.xls.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName order details.EXCEL.XLSx.xls.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName order details.EXCEL.XLSx.xls.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall order details.EXCEL.XLSx.xls.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall order details.EXCEL.XLSx.xls.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
order details.EXCEL.XLSx.xls.exeorder details.EXCEL.XLSx.xls.exedescription pid process target process PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1088 wrote to memory of 1408 1088 order details.EXCEL.XLSx.xls.exe order details.EXCEL.XLSx.xls.exe PID 1408 wrote to memory of 1040 1408 order details.EXCEL.XLSx.xls.exe cmd.exe PID 1408 wrote to memory of 1040 1408 order details.EXCEL.XLSx.xls.exe cmd.exe PID 1408 wrote to memory of 1040 1408 order details.EXCEL.XLSx.xls.exe cmd.exe PID 1408 wrote to memory of 1040 1408 order details.EXCEL.XLSx.xls.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.exe"C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\104349.bat" "C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.exe" "3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\104349.bat
-
memory/1040-3-0x0000000000000000-mapping.dmp
-
memory/1408-0-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1408-1-0x0000000000410621-mapping.dmp
-
memory/1408-2-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB