Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 05:48
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order-077.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Purchase order-077.exe
Resource
win10
General
-
Target
Purchase order-077.exe
-
Size
746KB
-
MD5
5db757b5513e230d3e64206a6973eca1
-
SHA1
e2695fb0884455889e720c4fecce6fed4950a135
-
SHA256
59d1d791b7fa9ee1614c83e54a56e0ef4f028027696a06087d1c587f02e1a4ac
-
SHA512
2768bde295afe87fa4d151974160d6b2a59d22115ed721e253c834419becc5c543cc26c8c36faeb7a120325f3d2c77842b5197f52bf8108678f67894cf440843
Malware Config
Signatures
-
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PBJ8CHQ8R = "C:\\Program Files (x86)\\O9r54\\dzc0or5drclrr-.exe" chkdsk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase order-077.exePurchase order-077.exechkdsk.exedescription pid process target process PID 772 set thread context of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 3644 set thread context of 2964 3644 Purchase order-077.exe Explorer.EXE PID 3644 set thread context of 2964 3644 Purchase order-077.exe Explorer.EXE PID 4032 set thread context of 2964 4032 chkdsk.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Purchase order-077.exechkdsk.exepid process 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Purchase order-077.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3644 Purchase order-077.exe Token: SeDebugPrivilege 4032 chkdsk.exe Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\O9r54\dzc0or5drclrr-.exe chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Purchase order-077.exeExplorer.EXEchkdsk.exedescription pid process target process PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 772 wrote to memory of 3644 772 Purchase order-077.exe Purchase order-077.exe PID 2964 wrote to memory of 4032 2964 Explorer.EXE chkdsk.exe PID 2964 wrote to memory of 4032 2964 Explorer.EXE chkdsk.exe PID 2964 wrote to memory of 4032 2964 Explorer.EXE chkdsk.exe PID 4032 wrote to memory of 3856 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 3856 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 3856 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 584 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 584 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 584 4032 chkdsk.exe cmd.exe PID 4032 wrote to memory of 344 4032 chkdsk.exe Firefox.exe PID 4032 wrote to memory of 344 4032 chkdsk.exe Firefox.exe PID 4032 wrote to memory of 344 4032 chkdsk.exe Firefox.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Purchase order-077.exechkdsk.exepid process 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 3644 Purchase order-077.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe 4032 chkdsk.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run entry to policy start application
- Enumerates system info in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase order-077.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Roaming\-LMATAB0\-LMlogim.jpeg
-
C:\Users\Admin\AppData\Roaming\-LMATAB0\-LMlogrf.ini
-
C:\Users\Admin\AppData\Roaming\-LMATAB0\-LMlogrg.ini
-
C:\Users\Admin\AppData\Roaming\-LMATAB0\-LMlogri.ini
-
C:\Users\Admin\AppData\Roaming\-LMATAB0\-LMlogrv.ini
-
memory/344-13-0x00007FF757950000-0x00007FF7579E3000-memory.dmpFilesize
588KB
-
memory/344-11-0x0000000000000000-mapping.dmp
-
memory/344-12-0x00007FF757950000-0x00007FF7579E3000-memory.dmpFilesize
588KB
-
memory/344-14-0x00007FF757950000-0x00007FF7579E3000-memory.dmpFilesize
588KB
-
memory/584-8-0x0000000000000000-mapping.dmp
-
memory/3644-1-0x000000000041E2A0-mapping.dmp
-
memory/3644-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3856-6-0x0000000000000000-mapping.dmp
-
memory/4032-7-0x0000000005BD0000-0x0000000005C9F000-memory.dmpFilesize
828KB
-
memory/4032-10-0x0000000007570000-0x0000000007669000-memory.dmpFilesize
996KB
-
memory/4032-5-0x0000000000C80000-0x0000000000C8A000-memory.dmpFilesize
40KB
-
memory/4032-4-0x0000000000C80000-0x0000000000C8A000-memory.dmpFilesize
40KB
-
memory/4032-3-0x0000000000000000-mapping.dmp