Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
order.exe
-
Size
399KB
-
MD5
d3f4595f210be5a466132637036d72c3
-
SHA1
980d63586e5116fdcbe87fe4e5914429a96f8655
-
SHA256
5962532a97c0efd1227d42aeddeacf09c0f8c8787e476e650d71ceed4ed52d97
-
SHA512
f263c92b4a966c1a5d916ec130a44eb75f87800165a81d9752248eede5f519cad9589e0a597a1249b9c36f2ed0ae0fa6eef445113b86ef934ca19c49b2b392f5
Score
8/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Enz7d\trylwhfdwtyrl.exe netsh.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer netsh.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YL8XNVKXLXL = "C:\\Program Files (x86)\\Enz7d\\trylwhfdwtyrl.exe" netsh.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3696 order.exe 3696 order.exe 3696 order.exe 3696 order.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3696 order.exe Token: SeDebugPrivilege 4036 netsh.exe Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 1820 wrote to memory of 3696 1820 order.exe 71 PID 3012 wrote to memory of 4036 3012 Explorer.EXE 73 PID 3012 wrote to memory of 4036 3012 Explorer.EXE 73 PID 3012 wrote to memory of 4036 3012 Explorer.EXE 73 PID 4036 wrote to memory of 3960 4036 netsh.exe 74 PID 4036 wrote to memory of 3960 4036 netsh.exe 74 PID 4036 wrote to memory of 3960 4036 netsh.exe 74 PID 4036 wrote to memory of 3836 4036 netsh.exe 76 PID 4036 wrote to memory of 3836 4036 netsh.exe 76 PID 4036 wrote to memory of 3836 4036 netsh.exe 76 PID 4036 wrote to memory of 3864 4036 netsh.exe 78 PID 4036 wrote to memory of 3864 4036 netsh.exe 78 PID 4036 wrote to memory of 3864 4036 netsh.exe 78 -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1820 set thread context of 3696 1820 order.exe 71 PID 3696 set thread context of 3012 3696 order.exe 55 PID 4036 set thread context of 3012 4036 netsh.exe 55 -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3696 order.exe 3696 order.exe 3696 order.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe 4036 netsh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\order.exe"C:\Users\Admin\AppData\Local\Temp\order.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\order.exe"C:\Users\Admin\AppData\Local\Temp\order.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3696
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3648
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Drops file in Program Files directory
- System policy modification
- Adds Run entry to policy start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4036 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\order.exe"3⤵PID:3960
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3836
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3864
-
-