d7a9047d6d19050866c5b5c7d08f4b45208d9b2a2a4f4179cadaf37ea92cfa89

General

Target

purchase order.exe
Size

1.1MB
MD5

17b50e88df8606876ddb8a1b1d3d4277
SHA1

159610f02b62f09eef08dd9ec324016a66899df8
SHA256

d7a9047d6d19050866c5b5c7d08f4b45208d9b2a2a4f4179cadaf37ea92cfa89
SHA512

4beb2b70a649a075d0bc6cd02730152795840742f606e68506f6409a2146dda65264d57ccc1d13a091532b5214501cd974abb01df18d22662d0c1549b3be4d38

Score

7^/10

spyware

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3232	3824	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3232	WerFault.exe
Token: SeBackupPrivilege	3232	WerFault.exe
Token: SeDebugPrivilege	3232	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe
3232	WerFault.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	purchase order.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	purchase order.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData:ApplicationData	purchase order.exe
File created	C:\ProgramData:ApplicationData	purchase order.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3824	3748	purchase order.exe	68
PID 3748 wrote to memory of 3824	3748	purchase order.exe	68
PID 3748 wrote to memory of 3824	3748	purchase order.exe	68
PID 3748 wrote to memory of 3856	3748	purchase order.exe	70
PID 3748 wrote to memory of 3856	3748	purchase order.exe	70
PID 3748 wrote to memory of 3856	3748	purchase order.exe	70
PID 3748 wrote to memory of 3856	3748	purchase order.exe	70
PID 3748 wrote to memory of 3856	3748	purchase order.exe	70

Loads dropped DLL 6 IoCs

pid	Process
3748	purchase order.exe
3748	purchase order.exe
3748	purchase order.exe
3748	purchase order.exe
3748	purchase order.exe
3748	purchase order.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3748	purchase order.exe

C:\Users\Admin\AppData\Local\Temp\purchase order.exe
"C:\Users\Admin\AppData\Local\Temp\purchase order.exe"
1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 700
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-10-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3232-3-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/3748-0-0x0000000003A10000-0x0000000003B64000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing