d923da79eb17e91ec59943ffa1c7eff0d340fc25dbc51b439d7c6ee4168b08b7

General

Target

ORDER10093683PDF.exe
Size

848KB
MD5

f2b299ac8cfc7645f338fb781543169d
SHA1

bd5bcc574cc039fcdbe5f20f6d92ed47a7b30d83
SHA256

d923da79eb17e91ec59943ffa1c7eff0d340fc25dbc51b439d7c6ee4168b08b7
SHA512

d015d38437a6a2a0b50978ed083a774b27a76f6289343c40731eb37d02bcc8f09a4222a4b7959c5dd93449be00c95e078c942dd03cc30e55c191eafbcc4496aa

Score

7^/10

spyware

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 1436	2920	ORDER10093683PDF.exe	74

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	ORDER10093683PDF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
736	schtasks.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 736	2920	ORDER10093683PDF.exe	72
PID 2920 wrote to memory of 736	2920	ORDER10093683PDF.exe	72
PID 2920 wrote to memory of 736	2920	ORDER10093683PDF.exe	72
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74
PID 2920 wrote to memory of 1436	2920	ORDER10093683PDF.exe	74

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1436	ORDER10093683PDF.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	ORDER10093683PDF.exe
1436	ORDER10093683PDF.exe

C:\Users\Admin\AppData\Local\Temp\ORDER10093683PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER10093683PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rzCtyBVuFekk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF325.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:736
- C:\Users\Admin\AppData\Local\Temp\ORDER10093683PDF.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  PID:1436