28e0480e53be4629a94065b585de49dd5c04e5c319cdc4f4be9c8631b44dbf68

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7
submitted
08/07/2020, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
List Of Approved ORDER-AZ2002-Alibaba.com.exe
Size 966KB
Sample200708-mlhh155sde
SHA256 28e0480e53be4629a94065b585de49dd5c04e5c319cdc4f4be9c8631b44dbf68
MD5 e1ce79c0f8b2953856eb9f09ac4485d1
SHA1 e59f9c0e4f6a2329f2d8f32e8c7663bd4f8f4c98
SHA512 62c39dc58959e481cc1930c697d824d147be3f28e9fe6f7c02b11cfdd1c885c00530cabe163ceed8d7ba284e396bf9d045cbc256191d76462d345f96243223b5
MD5 SHA1 SHA512

Score

7^/10

evasion trojan

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe
Token: SeDebugPrivilege	112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
Token: SeDebugPrivilege	1856	chkdsk.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 112 set thread context of 1228	112	List Of Approved ORDER-AZ2002-Alibaba.com.exe	20
PID 112 set thread context of 1228	112	List Of Approved ORDER-AZ2002-Alibaba.com.exe	20
PID 1856 set thread context of 1228	1856	chkdsk.exe	20

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
1856	chkdsk.exe
1856	chkdsk.exe

Deletes itself 1 IoCs

pid	Process
1884	cmd.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1620	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	24
PID 1464 wrote to memory of 1620	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	24
PID 1464 wrote to memory of 1620	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	24
PID 1464 wrote to memory of 1620	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	24
PID 1464 wrote to memory of 784	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	25
PID 1464 wrote to memory of 784	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	25
PID 1464 wrote to memory of 784	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	25
PID 1464 wrote to memory of 784	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	25
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1464 wrote to memory of 112	1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe	26
PID 1228 wrote to memory of 1856	1228	Explorer.EXE	40
PID 1228 wrote to memory of 1856	1228	Explorer.EXE	40
PID 1228 wrote to memory of 1856	1228	Explorer.EXE	40
PID 1228 wrote to memory of 1856	1228	Explorer.EXE	40
PID 1856 wrote to memory of 1884	1856	chkdsk.exe	41
PID 1856 wrote to memory of 1884	1856	chkdsk.exe	41
PID 1856 wrote to memory of 1884	1856	chkdsk.exe	41
PID 1856 wrote to memory of 1884	1856	chkdsk.exe	41

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe
1464	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
112	List Of Approved ORDER-AZ2002-Alibaba.com.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe
1856	chkdsk.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
PID:1228
- C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe
  "C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe
    "{path}"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe
    "{path}"
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe
    "{path}"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: EnumeratesProcesses
    PID:112
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:928
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1512
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1500
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1784
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1780
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  - Enumerates system info in registry
  PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"
    3⤵
    - Deletes itself
    PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1228-2-0x0000000004040000-0x00000000040FE000-memory.dmp

Download

memory/1856-4-0x0000000000130000-0x0000000000137000-memory.dmp

Download

memory/1856-6-0x0000000003120000-0x000000000328B000-memory.dmp

Download