Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10v200430 - submitted
21/07/2020, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe
- Size 750KB
- Sample200721-ax4ycfb91e
- SHA256 16c13e9c3a49e89d047f1b589596d24bc332af9d28ea6235aedd930e00b51281
- MD5 f5f99bf4a581180e9b7c0b2a0c31af27
- SHA1 d1d911710a427b0c13ea4ca9ebeceec950267597
- SHA512 97c99ace413423b45114601b2c14f56bc3fe9b3a18471ffc7e5979647af82bac9600ede62ceec7bf54125d1bdfa6868bfd91f839d11ac5b67d8a3c0ca60d7d24
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe Token: SeDebugPrivilege 3984 cmstp.exe Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6L9L_R-XX0QD = "C:\\Program Files (x86)\\V3fg41nq\\7njtqlyetw.exe" cmstp.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe 3984 cmstp.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2564 set thread context of 2236 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 66 PID 2236 set thread context of 2992 2236 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 56 PID 3984 set thread context of 2992 3984 cmstp.exe 56 - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2236 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 66 PID 2564 wrote to memory of 2236 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 66 PID 2564 wrote to memory of 2236 2564 SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe 66 PID 2992 wrote to memory of 3984 2992 Explorer.EXE 67 PID 2992 wrote to memory of 3984 2992 Explorer.EXE 67 PID 2992 wrote to memory of 3984 2992 Explorer.EXE 67 PID 3984 wrote to memory of 584 3984 cmstp.exe 68 PID 3984 wrote to memory of 584 3984 cmstp.exe 68 PID 3984 wrote to memory of 584 3984 cmstp.exe 68 PID 3984 wrote to memory of 4068 3984 cmstp.exe 76 PID 3984 wrote to memory of 4068 3984 cmstp.exe 76 PID 3984 wrote to memory of 4068 3984 cmstp.exe 76 PID 3984 wrote to memory of 3840 3984 cmstp.exe 78 PID 3984 wrote to memory of 3840 3984 cmstp.exe 78 PID 3984 wrote to memory of 3840 3984 cmstp.exe 78 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\V3fg41nq\7njtqlyetw.exe cmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2236
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
PID:3984 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.exe"3⤵PID:584
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:4068
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3840
-
-