Analysis
- max time kernel
71s - max time network
140s - platform
windows10_x64 - resource
win10v200722 - submitted
30/07/2020, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Sample Drawing 2020.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Purchase Sample Drawing 2020.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target New Purchase Sample Drawing 2020.exe
- Size 394KB
- Sample200730-tly414m4mn
- SHA256 e97d4cbbbb923b04cee8f87235ad15ab83a7cba51984422cdfdcfefa7e81d457
- MD5 b5b596310b5c18bf814c910eba8bef36
- SHA1 9c5e9b604848d9c8e9bc2dac40ad4ec1a6f94edc
- SHA512 c970f1f038325500ae9bbcaedc838a6d4270f16fc482ebaa01d896db22940af880a773d1b2326707328e6ceb64eec177239208dc6327561715691af37e8c90a4
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3900 New Purchase Sample Drawing 2020.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe 3900 New Purchase Sample Drawing 2020.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3900 wrote to memory of 1476 3900 New Purchase Sample Drawing 2020.exe 68 PID 3900 wrote to memory of 1476 3900 New Purchase Sample Drawing 2020.exe 68 PID 3900 wrote to memory of 1476 3900 New Purchase Sample Drawing 2020.exe 68 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 PID 3900 wrote to memory of 1544 3900 New Purchase Sample Drawing 2020.exe 69 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3900 set thread context of 1544 3900 New Purchase Sample Drawing 2020.exe 69 - Loads dropped DLL 6 IoCs
pid Process 1544 New Purchase Sample Drawing 2020.exe 1544 New Purchase Sample Drawing 2020.exe 1544 New Purchase Sample Drawing 2020.exe 1544 New Purchase Sample Drawing 2020.exe 1544 New Purchase Sample Drawing 2020.exe 1544 New Purchase Sample Drawing 2020.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ad69-6.dat js - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\wzimage = "\"C:\\Users\\Admin\\AppData\\Roaming\\wzimage.exe\"" New Purchase Sample Drawing 2020.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run key to start application
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"2⤵PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Sample Drawing 2020.exe"2⤵
- Loads dropped DLL
PID:1544
-