Analysis
- max time kernel
116s - max time network
142s - platform
windows7_x64 - resource
win7 - submitted
30/07/2020, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Sample Drawing 2020.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Purchase Sample Drawing 2020.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target New Purchase Sample Drawing 2020.exe
- Size 394KB
- Sample200730-tly414m4mn
- SHA256 e97d4cbbbb923b04cee8f87235ad15ab83a7cba51984422cdfdcfefa7e81d457
- MD5 b5b596310b5c18bf814c910eba8bef36
- SHA1 9c5e9b604848d9c8e9bc2dac40ad4ec1a6f94edc
- SHA512 c970f1f038325500ae9bbcaedc838a6d4270f16fc482ebaa01d896db22940af880a773d1b2326707328e6ceb64eec177239208dc6327561715691af37e8c90a4
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00030000000131cd-6.dat js - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\wzimage = "\"C:\\Users\\Admin\\AppData\\Roaming\\wzimage.exe\"" New Purchase Sample Drawing 2020.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 New Purchase Sample Drawing 2020.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe 900 New Purchase Sample Drawing 2020.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 PID 900 wrote to memory of 1032 900 New Purchase Sample Drawing 2020.exe 24 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 900 set thread context of 1032 900 New Purchase Sample Drawing 2020.exe 24 - Loads dropped DLL 6 IoCs
pid Process 1032 New Purchase Sample Drawing 2020.exe 1032 New Purchase Sample Drawing 2020.exe 1032 New Purchase Sample Drawing 2020.exe 1032 New Purchase Sample Drawing 2020.exe 1032 New Purchase Sample Drawing 2020.exe 1032 New Purchase Sample Drawing 2020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:900 -
C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"2⤵
- Loads dropped DLL
PID:1032
-