Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:38
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.exe
-
Size
489KB
-
MD5
e2617fc4c82436c96092b5b812bfa8ad
-
SHA1
9337e67fb93d8fec2c64f08156389ae313297faa
-
SHA256
777724ddfa6e73aca46c52991e3805ac1fabee9359fa362d9e084f4d2461fa04
-
SHA512
96708fde6622ba1d27e349c116c25cea047123cd0d2c3d9e152a81d1c36e5048a9bb478917c13aea174d77ae68447b4634d253b284dcaaa6e37c5443fd4cd5e1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Purchase Order.exepid process 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe 4120 Purchase Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order.exedescription pid process Token: SeDebugPrivilege 4120 Purchase Order.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4120-130-0x0000000000220000-0x00000000002A0000-memory.dmpFilesize
512KB
-
memory/4120-131-0x00000000052D0000-0x0000000005874000-memory.dmpFilesize
5.6MB
-
memory/4120-132-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/4120-133-0x0000000004D00000-0x0000000004D0A000-memory.dmpFilesize
40KB
-
memory/4120-134-0x0000000004FB0000-0x000000000504C000-memory.dmpFilesize
624KB
-
memory/4120-135-0x0000000005250000-0x00000000052B6000-memory.dmpFilesize
408KB