Analysis
- max time kernel
145s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
08/07/2020, 06:11
Static task
static1
Behavioral task
behavioral1
Sample
List Of Approved ORDER-AZ2002-Alibaba.com.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
List Of Approved ORDER-AZ2002-Alibaba.com.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target List Of Approved ORDER-AZ2002-Alibaba.com.exe
- Size 966KB
- Sample200708-mlhh155sde
- SHA256 28e0480e53be4629a94065b585de49dd5c04e5c319cdc4f4be9c8631b44dbf68
- MD5 e1ce79c0f8b2953856eb9f09ac4485d1
- SHA1 e59f9c0e4f6a2329f2d8f32e8c7663bd4f8f4c98
- SHA512 62c39dc58959e481cc1930c697d824d147be3f28e9fe6f7c02b11cfdd1c885c00530cabe163ceed8d7ba284e396bf9d045cbc256191d76462d345f96243223b5
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2988 Explorer.EXE 2988 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3812 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 67 PID 2460 wrote to memory of 3812 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 67 PID 2460 wrote to memory of 3812 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 67 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 2460 wrote to memory of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 3832 wrote to memory of 3864 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 69 PID 3832 wrote to memory of 3864 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 69 PID 3832 wrote to memory of 3864 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 69 PID 3864 wrote to memory of 3868 3864 wlanext.exe 70 PID 3864 wrote to memory of 3868 3864 wlanext.exe 70 PID 3864 wrote to memory of 3868 3864 wlanext.exe 70 - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe Token: SeDebugPrivilege 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe Token: SeDebugPrivilege 3864 wlanext.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe 3864 wlanext.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2460 set thread context of 3832 2460 List Of Approved ORDER-AZ2002-Alibaba.com.exe 68 PID 3832 set thread context of 2988 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 56 PID 3832 set thread context of 2988 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 56 PID 3864 set thread context of 2988 3864 wlanext.exe 56 - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3832 List Of Approved ORDER-AZ2002-Alibaba.com.exe 3864 wlanext.exe 3864 wlanext.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2988 Explorer.EXE 2988 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"{path}"3⤵PID:3812
-
-
C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"{path}"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3832 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3864 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\List Of Approved ORDER-AZ2002-Alibaba.com.exe"5⤵PID:3868
-
-
-
-