Analysis
- max time kernel
76s - max time network
68s - platform
windows10_x64 - resource
win10 - submitted
31/08/2020, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Airway Bill_pdf.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Shipment Airway Bill_pdf.exe
- Size 937KB
- Sample200831-8tftbeph7a
- SHA256 be2574eff410b1b63255c93f82e398c50b7af0f7431786e49b1dc922fbb5a910
- MD5 8842ab4d1c104bca252908f93d85094e
- SHA1 e6b7c6ec096825d85916625a635917b0b2181ec0
- SHA512 c3a40096fafa403e9d9a0d5131c576521198781ea75b1336269f768101e1594f249256ce7d653f4eee9472a2bce6299c93217fe88e7464250816cdaebe4e811d
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3832 set thread context of 632 3832 Shipment Airway Bill_pdf.exe 71 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = db01345f5a7fd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3832 Shipment Airway Bill_pdf.exe 3832 Shipment Airway Bill_pdf.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3832 Shipment Airway Bill_pdf.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeImpersonatePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeTcbPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeChangeNotifyPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeCreateTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeBackupPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeRestorePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeIncreaseQuotaPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeAssignPrimaryTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeShutdownPrivilege 1124 svchost.exe Token: SeCreatePagefilePrivilege 1124 svchost.exe Token: SeImpersonatePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeTcbPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeChangeNotifyPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeCreateTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeBackupPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeRestorePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeIncreaseQuotaPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeAssignPrimaryTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeImpersonatePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeTcbPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeChangeNotifyPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeCreateTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeBackupPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeRestorePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeIncreaseQuotaPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeAssignPrimaryTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeImpersonatePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeTcbPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeChangeNotifyPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeCreateTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeBackupPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeRestorePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeIncreaseQuotaPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeAssignPrimaryTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeImpersonatePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeTcbPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeChangeNotifyPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeCreateTokenPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeBackupPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeRestorePrivilege 632 Shipment Airway Bill_pdf.exe Token: SeIncreaseQuotaPrivilege 632 Shipment Airway Bill_pdf.exe Token: SeAssignPrimaryTokenPrivilege 632 Shipment Airway Bill_pdf.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3832 wrote to memory of 632 3832 Shipment Airway Bill_pdf.exe 71 PID 3832 wrote to memory of 632 3832 Shipment Airway Bill_pdf.exe 71 PID 3832 wrote to memory of 632 3832 Shipment Airway Bill_pdf.exe 71 PID 632 wrote to memory of 1576 632 Shipment Airway Bill_pdf.exe 74 PID 632 wrote to memory of 1576 632 Shipment Airway Bill_pdf.exe 74 PID 632 wrote to memory of 1576 632 Shipment Airway Bill_pdf.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Airway Bill_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Airway Bill_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\Shipment Airway Bill_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Airway Bill_pdf.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259267203.bat" "C:\Users\Admin\AppData\Local\Temp\Shipment Airway Bill_pdf.exe" "3⤵PID:1576
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1124