Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 10:28
Static task
static1
Behavioral task
behavioral1
Sample
July Approved Order_PDF.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
July Approved Order_PDF.exe
Resource
win10
General
-
Target
July Approved Order_PDF.exe
-
Size
364KB
-
MD5
82fd63f045b5afd0834a9b1b579318fb
-
SHA1
7df3257d74c240f440c8ef001a414f6372a84724
-
SHA256
25e2619309515f2a7953682e8d4ea6d13b9c7030159aefbb8521d4316a58c19d
-
SHA512
7ea44d652f5ecfaafb141090aff32f3bc14b5c0acf2ad5457ebf4d7c1cc74aed8a16bda245b75fd105893c0a8deef9fff1555acf336adc7009106b6b3ff4cdd9
Malware Config
Signatures
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\_DPHLFGH = "C:\\Program Files (x86)\\Lxtkd\\user_nu0.exe" msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
July Approved Order_PDF.exeJuly Approved Order_PDF.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1360 July Approved Order_PDF.exe Token: SeDebugPrivilege 1224 July Approved Order_PDF.exe Token: SeDebugPrivilege 1820 msiexec.exe -
Loads dropped DLL 1 IoCs
Processes:
July Approved Order_PDF.exepid process 1360 July Approved Order_PDF.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
July Approved Order_PDF.exeJuly Approved Order_PDF.exemsiexec.exedescription pid process target process PID 1360 set thread context of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1224 set thread context of 1324 1224 July Approved Order_PDF.exe Explorer.EXE PID 1820 set thread context of 1324 1820 msiexec.exe Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
July Approved Order_PDF.exemsiexec.exepid process 1224 July Approved Order_PDF.exe 1224 July Approved Order_PDF.exe 1224 July Approved Order_PDF.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\Lxtkd\user_nu0.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
July Approved Order_PDF.exeJuly Approved Order_PDF.exemsiexec.exepid process 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1360 July Approved Order_PDF.exe 1224 July Approved Order_PDF.exe 1224 July Approved Order_PDF.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
July Approved Order_PDF.exepid process 1224 July Approved Order_PDF.exe -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
July Approved Order_PDF.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1360 wrote to memory of 1224 1360 July Approved Order_PDF.exe July Approved Order_PDF.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1820 1324 Explorer.EXE msiexec.exe PID 1820 wrote to memory of 1740 1820 msiexec.exe cmd.exe PID 1820 wrote to memory of 1740 1820 msiexec.exe cmd.exe PID 1820 wrote to memory of 1740 1820 msiexec.exe cmd.exe PID 1820 wrote to memory of 1740 1820 msiexec.exe cmd.exe PID 1820 wrote to memory of 532 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 532 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 532 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 532 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 532 1820 msiexec.exe Firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logim.jpeg
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrf.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logri.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrv.ini
-
\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe
-
memory/532-13-0x0000000000000000-mapping.dmp
-
memory/532-14-0x000000013FC70000-0x000000013FD03000-memory.dmpFilesize
588KB
-
memory/1224-1-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1224-2-0x000000000041E2D0-mapping.dmp
-
memory/1740-6-0x0000000000000000-mapping.dmp
-
memory/1820-4-0x0000000000000000-mapping.dmp
-
memory/1820-12-0x0000000003AF0000-0x0000000003C75000-memory.dmpFilesize
1.5MB
-
memory/1820-9-0x0000000076910000-0x0000000076A2D000-memory.dmpFilesize
1.1MB
-
memory/1820-8-0x0000000075870000-0x000000007587C000-memory.dmpFilesize
48KB
-
memory/1820-7-0x0000000002060000-0x00000000021B6000-memory.dmpFilesize
1.3MB
-
memory/1820-5-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB