Analysis
- max time kernel
71s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/04/2022, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order-16905.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order-16905.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target Purchase Order-16905.exe
- Size 360KB
- Sample220421-m2tjfsafbr
- SHA256 b759aa1730a87cec1d078918f05e645fa774b1df4b2551ba4aaa904acc461e01
- MD5 1024adf4f8248593f19690de9ff0fc8f
- SHA1 2ff56a6e3933164fb8d3beeeea972e458d7f73ed
- SHA512 20cb3051ea8689df2b14b55cd44508037a4665d7e3b813867cfd3f90dbae831d43348ee36b9714693fbe79b8103494d472c325333d125ba5b5e593f8e54fe1ba
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://hospinorte.com.py/wp-includes/docd/panel/gate.php
-
http://hospinorte.com.py/wp-includes/docd/panel/amara.php
Signatures
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts InstallUtil.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Werexes = "\"C:\\Users\\Admin\\AppData\\Roaming\\Qmuurvol\\Werexes.exe\"" Purchase Order-16905.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3664 set thread context of 1236 3664 Purchase Order-16905.exe 80 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3664 Purchase Order-16905.exe 3664 Purchase Order-16905.exe 3664 Purchase Order-16905.exe 3664 Purchase Order-16905.exe 3664 Purchase Order-16905.exe 3664 Purchase Order-16905.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3664 Purchase Order-16905.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe Token: SeImpersonatePrivilege 1236 InstallUtil.exe Token: SeTcbPrivilege 1236 InstallUtil.exe Token: SeChangeNotifyPrivilege 1236 InstallUtil.exe Token: SeCreateTokenPrivilege 1236 InstallUtil.exe Token: SeBackupPrivilege 1236 InstallUtil.exe Token: SeRestorePrivilege 1236 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 1236 InstallUtil.exe Token: SeAssignPrimaryTokenPrivilege 1236 InstallUtil.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3744 3664 Purchase Order-16905.exe 79 PID 3664 wrote to memory of 3744 3664 Purchase Order-16905.exe 79 PID 3664 wrote to memory of 3744 3664 Purchase Order-16905.exe 79 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 3664 wrote to memory of 1236 3664 Purchase Order-16905.exe 80 PID 1236 wrote to memory of 2392 1236 InstallUtil.exe 81 PID 1236 wrote to memory of 2392 1236 InstallUtil.exe 81 PID 1236 wrote to memory of 2392 1236 InstallUtil.exe 81 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-16905.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-16905.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵PID:3744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240550578.bat" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" "3⤵PID:2392
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\240550578.bat
- Size 94B
- SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
- MD5 3880eeb1c736d853eb13b44898b718ab
- SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
- SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
- MD5 SHA1 SHA512