e336780f3321d06dfea57c94467d65e0ab2ab92d77c0267cf17b8d51359a5e38

Analysis

max time kernel
63s
max time network
63s
platform
windows7_x64
resource
win7
submitted
16/07/2020, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

New Order Request Document03.com.exe
Size

701KB
MD5

7da72e4e2a596ab29f1c082ef1802564
SHA1

dfcb8c055a895f0e8593b471f57a7fd0e62c5d4f
SHA256

e336780f3321d06dfea57c94467d65e0ab2ab92d77c0267cf17b8d51359a5e38
SHA512

e8f4a8e175be4edab2e58e9adcdbbc37027768f9793f1705559a7f1bdd59b0f8dcf2433b157f28f847f4eb4656739220c910132a628549f9e1a1160568936f7e

Score

6^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1088	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1312	1088	New Order Request Document03.com.exe	24
PID 1088 wrote to memory of 1312	1088	New Order Request Document03.com.exe	24
PID 1088 wrote to memory of 1312	1088	New Order Request Document03.com.exe	24
PID 1088 wrote to memory of 1312	1088	New Order Request Document03.com.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1312	WerFault.exe
1312	WerFault.exe
1312	WerFault.exe
1312	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\GpYMi = "C:\\AVGLFESB\\GpYMim\\GpYMimsml.vbs"	New Order Request Document03.com.exe

C:\Users\Admin\AppData\Local\Temp\New Order Request Document03.com.exe
"C:\Users\Admin\AppData\Local\Temp\New Order Request Document03.com.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 7360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-1-0x00000000020D0000-0x00000000020E1000-memory.dmp

Filesize
68KB

Download
memory/1312-2-0x00000000024A0000-0x00000000024B1000-memory.dmp

Filesize
68KB

Download