Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v200430 - submitted
17/07/2020, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
quotation ref doc.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
quotation ref doc.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target quotation ref doc.exe
- Size 251KB
- Sample200717-m2ry8bpxp6
- SHA256 9b861daa0a7b4276df89a7ec49d2dd3388366ad60a3058df70525313799a0d05
- MD5 3d6c069a2e8a3820de1e6a18f5178aee
- SHA1 df9463625727250c15e5fe8bd7019a01f3ce587e
- SHA512 770179ed1195e6c9fe2687e48b8832a22627f957dcd9fe74aa9f01c024d034c17814373facbba5beaaf63499f09f9e4b2a3379d39ca2fa12e5b9451e84bf66e9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2028 1612 quotation ref doc.exe 68 PID 1612 wrote to memory of 2028 1612 quotation ref doc.exe 68 PID 1612 wrote to memory of 2028 1612 quotation ref doc.exe 68 PID 1612 wrote to memory of 2028 1612 quotation ref doc.exe 68 PID 3024 wrote to memory of 1980 3024 Explorer.EXE 70 PID 3024 wrote to memory of 1980 3024 Explorer.EXE 70 PID 3024 wrote to memory of 1980 3024 Explorer.EXE 70 PID 1980 wrote to memory of 1848 1980 mstsc.exe 71 PID 1980 wrote to memory of 1848 1980 mstsc.exe 71 PID 1980 wrote to memory of 1848 1980 mstsc.exe 71 PID 1980 wrote to memory of 3944 1980 mstsc.exe 77 PID 1980 wrote to memory of 3944 1980 mstsc.exe 77 PID 1980 wrote to memory of 3944 1980 mstsc.exe 77 PID 1980 wrote to memory of 4056 1980 mstsc.exe 79 PID 1980 wrote to memory of 4056 1980 mstsc.exe 79 PID 1980 wrote to memory of 4056 1980 mstsc.exe 79 - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2028 RegAsm.exe 2028 RegAsm.exe 2028 RegAsm.exe 2028 RegAsm.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9R2LT08HTHT = "C:\\Program Files (x86)\\Yazdpi6m\\jfhtxf2k.exe" mstsc.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe quotation ref doc.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Yazdpi6m\jfhtxf2k.exe mstsc.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1612 quotation ref doc.exe 2028 RegAsm.exe 2028 RegAsm.exe 2028 RegAsm.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe 1980 mstsc.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1612 set thread context of 2028 1612 quotation ref doc.exe 68 PID 2028 set thread context of 3024 2028 RegAsm.exe 56 PID 1980 set thread context of 3024 1980 mstsc.exe 56 - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2028 RegAsm.exe Token: SeDebugPrivilege 1980 mstsc.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\quotation ref doc.exe"C:\Users\Admin\AppData\Local\Temp\quotation ref doc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3396
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
PID:1980 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1848
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3944
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4056
-
-