Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
13/07/2020, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
order list.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order list.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
order list.exe
-
Size
296KB
-
MD5
76bb6a33ec5f8f6bd9defe4341871e98
-
SHA1
0ec9277d8c2e410440485c7cd2202ef877d49230
-
SHA256
7910fbd27cb1e4fd04a3356d45036821ed924ef1b8de3117d677be4938cb5140
-
SHA512
806dade1f74874d3c6cb3acdabee50ebc3a6cd4927d57e83e7136b448fe0a207a3a0e440be3668b2116e2043452cf1f0327aedc1e7542a7e8684b53eda7d10d9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1496 wrote to memory of 736 1496 order list.exe 24 PID 1496 wrote to memory of 736 1496 order list.exe 24 PID 1496 wrote to memory of 736 1496 order list.exe 24 PID 1496 wrote to memory of 736 1496 order list.exe 24 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1496 wrote to memory of 324 1496 order list.exe 25 PID 1228 wrote to memory of 732 1228 Explorer.EXE 26 PID 1228 wrote to memory of 732 1228 Explorer.EXE 26 PID 1228 wrote to memory of 732 1228 Explorer.EXE 26 PID 1228 wrote to memory of 732 1228 Explorer.EXE 26 PID 732 wrote to memory of 1500 732 chkdsk.exe 27 PID 732 wrote to memory of 1500 732 chkdsk.exe 27 PID 732 wrote to memory of 1500 732 chkdsk.exe 27 PID 732 wrote to memory of 1500 732 chkdsk.exe 27 -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1496 order list.exe 324 vbc.exe 324 vbc.exe 324 vbc.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe 732 chkdsk.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1496 order list.exe Token: SeDebugPrivilege 324 vbc.exe Token: SeDebugPrivilege 732 chkdsk.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1496 set thread context of 324 1496 order list.exe 25 PID 324 set thread context of 1228 324 vbc.exe 20 PID 324 set thread context of 1228 324 vbc.exe 20 PID 732 set thread context of 1228 732 chkdsk.exe 20 -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 324 vbc.exe 324 vbc.exe 324 vbc.exe 324 vbc.exe 732 chkdsk.exe 732 chkdsk.exe -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵PID:736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:324
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Enumerates system info in registry
PID:732 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:1500
-
-