Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
08/07/2020, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order-077.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase order-077.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Purchase order-077.exe
- Size 746KB
- Sample200708-2smmkja3qs
- SHA256 59d1d791b7fa9ee1614c83e54a56e0ef4f028027696a06087d1c587f02e1a4ac
- MD5 5db757b5513e230d3e64206a6973eca1
- SHA1 e2695fb0884455889e720c4fecce6fed4950a135
- SHA512 2768bde295afe87fa4d151974160d6b2a59d22115ed721e253c834419becc5c543cc26c8c36faeb7a120325f3d2c77842b5197f52bf8108678f67894cf440843
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PBJ8CHQ8R = "C:\\Program Files (x86)\\O9r54\\dzc0or5drclrr-.exe" chkdsk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 772 set thread context of 3644 772 Purchase order-077.exe 66 PID 3644 set thread context of 2964 3644 Purchase order-077.exe 56 PID 3644 set thread context of 2964 3644 Purchase order-077.exe 56 PID 4032 set thread context of 2964 4032 chkdsk.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3644 Purchase order-077.exe Token: SeDebugPrivilege 4032 chkdsk.exe Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\O9r54\dzc0or5drclrr-.exe chkdsk.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 772 wrote to memory of 3644 772 Purchase order-077.exe 66 PID 2964 wrote to memory of 4032 2964 Explorer.EXE 67 PID 2964 wrote to memory of 4032 2964 Explorer.EXE 67 PID 2964 wrote to memory of 4032 2964 Explorer.EXE 67 PID 4032 wrote to memory of 3856 4032 chkdsk.exe 68 PID 4032 wrote to memory of 3856 4032 chkdsk.exe 68 PID 4032 wrote to memory of 3856 4032 chkdsk.exe 68 PID 4032 wrote to memory of 584 4032 chkdsk.exe 76 PID 4032 wrote to memory of 584 4032 chkdsk.exe 76 PID 4032 wrote to memory of 584 4032 chkdsk.exe 76 PID 4032 wrote to memory of 344 4032 chkdsk.exe 78 PID 4032 wrote to memory of 344 4032 chkdsk.exe 78 PID 4032 wrote to memory of 344 4032 chkdsk.exe 78 - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:3644
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run entry to policy start application
- Enumerates system info in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- System policy modification
PID:4032 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"3⤵PID:3856
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:584
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:344
-
-