dff0bf7c85f01cf94f21c7bdd224fe0b3d73dcad9cb38fa40eef4685c9bc63ab

Analysis

max time kernel
131s
max time network
46s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ Request For Quotation.doc. .exe
Size

1.0MB
MD5

087a1ecc3d720b786d8cc8544bc469ed
SHA1

721623d6904a1c9e8168c3f104840490b5b52491
SHA256

dff0bf7c85f01cf94f21c7bdd224fe0b3d73dcad9cb38fa40eef4685c9bc63ab
SHA512

ae12605396dc568f7da9d9fdfb5518bcedea190c0c7f3d39d9773c76fee41bc5f0daf966ca31bba6acccdc5be867e64a30c6c1deed2425713db1226c196d5981

Score

8^/10

evasion

Malware Config

Signatures

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4088	1732	RFQ Request For Quotation.doc. .exe	68
PID 1732 wrote to memory of 4088	1732	RFQ Request For Quotation.doc. .exe	68
PID 1732 wrote to memory of 4088	1732	RFQ Request For Quotation.doc. .exe	68
PID 4088 wrote to memory of 2440	4088	WScript.exe	69
PID 4088 wrote to memory of 2440	4088	WScript.exe	69
PID 4088 wrote to memory of 2440	4088	WScript.exe	69
PID 2440 wrote to memory of 2576	2440	cmd.exe	71
PID 2440 wrote to memory of 2576	2440	cmd.exe	71
PID 2440 wrote to memory of 2576	2440	cmd.exe	71
PID 2576 wrote to memory of 2740	2576	net.exe	72
PID 2576 wrote to memory of 2740	2576	net.exe	72
PID 2576 wrote to memory of 2740	2576	net.exe	72
PID 2440 wrote to memory of 3716	2440	cmd.exe	73
PID 2440 wrote to memory of 3716	2440	cmd.exe	73
PID 2440 wrote to memory of 3716	2440	cmd.exe	73
PID 3716 wrote to memory of 3012	3716	WScript.exe	74
PID 3716 wrote to memory of 3012	3716	WScript.exe	74
PID 3716 wrote to memory of 3012	3716	WScript.exe	74
PID 3012 wrote to memory of 4068	3012	cmd.exe	76
PID 3012 wrote to memory of 4068	3012	cmd.exe	76
PID 3012 wrote to memory of 4068	3012	cmd.exe	76
PID 3012 wrote to memory of 3564	3012	cmd.exe	77
PID 3012 wrote to memory of 3564	3012	cmd.exe	77
PID 3012 wrote to memory of 3564	3012	cmd.exe	77
PID 3012 wrote to memory of 3752	3012	cmd.exe	78
PID 3012 wrote to memory of 3752	3012	cmd.exe	78
PID 3012 wrote to memory of 3752	3012	cmd.exe	78

Runs net.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4068	attrib.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	RFQ Request For Quotation.doc. .exe

C:\Users\Admin\AppData\Local\Temp\RFQ Request For Quotation.doc. .exe
"C:\Users\Admin\AppData\Local\Temp\RFQ Request For Quotation.doc. .exe"
1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:1732
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\Adobe.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\Adobe03.bat" /quiet /norestart"
    3⤵
    - Suspicious use of WriteProcessMemory
    - Modifies registry class
    PID:2440
  - - C:\Windows\SysWOW64\net.exe
      NET FILE
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 FILE
        5⤵
        
        PID:2740
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\adobel.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\adobe01.bat" /quiet /norestart"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe INC\AadobeRead\"
        6⤵
        Views/modifies file attributes
        
        PID:4068
      - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /h /e /r /k /c *.* "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe Inc\AadobeRead\"
        6⤵
        Enumerates system info in registry
        
        PID:3564
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe Inc\AadobeRead\adob02.bat"
        6⤵
        
        PID:3752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads