b6cc6aed76d1b7e069209d41f75b0275cd99154d75672214c039d8bc0e2eae98

Analysis

max time kernel
94s
max time network
112s
platform
windows10_x64
resource
win10
submitted
31/08/2020, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order Items.exe
Size 1.1MB
Sample200831-ejv9ykcawj
SHA256 b6cc6aed76d1b7e069209d41f75b0275cd99154d75672214c039d8bc0e2eae98
MD5 f96fe999c903f4cbdd0e1d473b289e4a
SHA1 11a882b9a1e405c216ef020e822dda4b88071e01
SHA512 47f52eee895bce9b5cb20bfb3b8f41a43b5e53fe0195137f75053e606a6052d5b87ddf2d4ef94b3350e6211bf2f722ef90fc3ea4f36c8edd6137001b04fd9d12
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3732	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3840 set thread context of 2000	3840	Order Items.exe	76

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = e254a17f5b7fd601	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2000	Order Items.exe
2000	Order Items.exe
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3336	svchost.exe
Token: SeCreatePagefilePrivilege	3336	svchost.exe
Token: SeDebugPrivilege	2000	Order Items.exe
Token: SeDebugPrivilege	3732	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 3840 wrote to memory of 2000	3840	Order Items.exe	76
PID 2000 wrote to memory of 3744	2000	Order Items.exe	78
PID 2000 wrote to memory of 3744	2000	Order Items.exe	78
PID 2000 wrote to memory of 3744	2000	Order Items.exe	78
PID 3744 wrote to memory of 3732	3744	cmd.exe	80
PID 3744 wrote to memory of 3732	3744	cmd.exe	80
PID 3744 wrote to memory of 3732	3744	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\Order Items.exe
"C:\Users\Admin\AppData\Local\Temp\Order Items.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\Order Items.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Items.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Order Items.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Order Items.exe'
      4⤵
      Deletes itself
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-20-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/2000-11-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/2000-19-0x00000000055B0000-0x0000000005621000-memory.dmp

Download

memory/2000-14-0x0000000073410000-0x0000000073AFE000-memory.dmp

Download

memory/3732-33-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Download

memory/3732-35-0x00000000092F0000-0x00000000092F1000-memory.dmp

Download

memory/3732-31-0x00000000074F0000-0x00000000074F1000-memory.dmp

Download

memory/3732-29-0x0000000006B80000-0x0000000006B81000-memory.dmp

Download

memory/3732-37-0x0000000008C70000-0x0000000008C71000-memory.dmp

Download

memory/3732-34-0x0000000007B60000-0x0000000007B61000-memory.dmp

Download

memory/3732-38-0x0000000006950000-0x0000000006951000-memory.dmp

Download

memory/3732-32-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

Download

memory/3732-36-0x0000000008880000-0x0000000008881000-memory.dmp

Download

memory/3732-27-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/3732-28-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/3732-25-0x0000000073490000-0x0000000073B7E000-memory.dmp

Download

memory/3732-26-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3840-0-0x0000000073410000-0x0000000073AFE000-memory.dmp

Download

memory/3840-10-0x0000000006340000-0x0000000006404000-memory.dmp

Download

memory/3840-9-0x0000000006040000-0x0000000006125000-memory.dmp

Download

memory/3840-8-0x00000000052C0000-0x00000000052CB000-memory.dmp

Download

memory/3840-7-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3840-6-0x0000000005200000-0x0000000005201000-memory.dmp

Download

memory/3840-5-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/3840-4-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/3840-3-0x0000000005110000-0x0000000005111000-memory.dmp

Download

memory/3840-1-0x0000000000830000-0x0000000000831000-memory.dmp

Download