Analysis
- max time kernel
146s - max time network
133s - platform
windows10_x64 - resource
win10v200722 - submitted
29/07/2020, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Purchase Order.exe
- Size 484KB
- Sample200729-syexytb5ss
- SHA256 e3a859708d3e54210dbd7aaf0a2a78e1a11e8e2b3dcd358f91c3aa5091b94bf0
- MD5 5d3d308f1c8fe82e0184f40d5ff80d4b
- SHA1 821bd32f666f778e22c395def5d7bda97a4247f5
- SHA512 2b3f9d2d4fdd2f25295b3f1d155b8c7af6c1d9f213c5ca3681510f5b9d27477abe5b3b7e1aa1300588c8e2524287d3cbcd5ad0132d07b8c349f29938bd1927b7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 732 set thread context of 608 732 Purchase Order.exe 67 PID 608 set thread context of 2968 608 WinSec.exe 56 PID 1312 set thread context of 2968 1312 msiexec.exe 56 PID 1312 set thread context of 1152 1312 msiexec.exe 68 - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 608 WinSec.exe 608 WinSec.exe 608 WinSec.exe 608 WinSec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 608 WinSec.exe 608 WinSec.exe 608 WinSec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe 1312 msiexec.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 732 Purchase Order.exe Token: SeDebugPrivilege 608 WinSec.exe Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeDebugPrivilege 1312 msiexec.exe Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE - Executes dropped EXE 1 IoCs
pid Process 608 WinSec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1152 NOTEPAD.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings Purchase Order.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Xpvp8dj\ejqti8drt2hup.exe msiexec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GJOTEHP8JL30 = "C:\\Program Files (x86)\\Xpvp8dj\\ejqti8drt2hup.exe" msiexec.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 608 732 Purchase Order.exe 67 PID 732 wrote to memory of 1152 732 Purchase Order.exe 68 PID 732 wrote to memory of 1152 732 Purchase Order.exe 68 PID 732 wrote to memory of 1152 732 Purchase Order.exe 68 PID 2968 wrote to memory of 1312 2968 Explorer.EXE 69 PID 2968 wrote to memory of 1312 2968 Explorer.EXE 69 PID 2968 wrote to memory of 1312 2968 Explorer.EXE 69 PID 1312 wrote to memory of 1528 1312 msiexec.exe 70 PID 1312 wrote to memory of 1528 1312 msiexec.exe 70 PID 1312 wrote to memory of 1528 1312 msiexec.exe 70 PID 1312 wrote to memory of 3124 1312 msiexec.exe 78 PID 1312 wrote to memory of 3124 1312 msiexec.exe 78 PID 1312 wrote to memory of 3124 1312 msiexec.exe 78 PID 1312 wrote to memory of 3732 1312 msiexec.exe 80 PID 1312 wrote to memory of 3732 1312 msiexec.exe 80 PID 1312 wrote to memory of 3732 1312 msiexec.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\WinSec.exeC:\Users\Admin\AppData\Local\Temp\WinSec.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:608
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\4501.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1152
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\WinSec.exe"3⤵PID:1528
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3124
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3732
-
-