Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16/07/2020, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
PURCHASE ORDER.exe
-
Size
534KB
-
MD5
30a88aaca2412bcc3914382dce41ae1a
-
SHA1
4abbc932878a42eec7a438fc383370e83ea43d7e
-
SHA256
57234a3ec3bf2d3e6539a25221595d791fcf68dbed39a942651819c74fc3c664
-
SHA512
8db262de282eaa5471963eae4f08729b21728cf783184d819221fba6283153817aa71f8a7f22f0d6ee24bd123fd2b9dfea9fb20c46db1a62710ebdaab3958b94
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 1008 wrote to memory of 2068 1008 PURCHASE ORDER.exe 71 PID 2992 wrote to memory of 2196 2992 Explorer.EXE 72 PID 2992 wrote to memory of 2196 2992 Explorer.EXE 72 PID 2992 wrote to memory of 2196 2992 Explorer.EXE 72 PID 2196 wrote to memory of 2752 2196 colorcpl.exe 74 PID 2196 wrote to memory of 2752 2196 colorcpl.exe 74 PID 2196 wrote to memory of 2752 2196 colorcpl.exe 74 PID 2196 wrote to memory of 3836 2196 colorcpl.exe 76 PID 2196 wrote to memory of 3836 2196 colorcpl.exe 76 PID 2196 wrote to memory of 3836 2196 colorcpl.exe 76 PID 2196 wrote to memory of 3728 2196 colorcpl.exe 78 PID 2196 wrote to memory of 3728 2196 colorcpl.exe 78 PID 2196 wrote to memory of 3728 2196 colorcpl.exe 78 -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2068 PURCHASE ORDER.exe 2068 PURCHASE ORDER.exe 2068 PURCHASE ORDER.exe 2068 PURCHASE ORDER.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2068 PURCHASE ORDER.exe Token: SeDebugPrivilege 2196 colorcpl.exe Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2068 PURCHASE ORDER.exe 2068 PURCHASE ORDER.exe 2068 PURCHASE ORDER.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe 2196 colorcpl.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\A69L_RCXGVE = "C:\\Program Files (x86)\\Tcvulh\\idbxvt3d.exe" colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1008 set thread context of 2068 1008 PURCHASE ORDER.exe 71 PID 2068 set thread context of 2992 2068 PURCHASE ORDER.exe 56 PID 2196 set thread context of 2992 2196 colorcpl.exe 56 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Tcvulh\idbxvt3d.exe colorcpl.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2068
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System policy modification
PID:2196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"3⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3836
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3728
-
-