fa727bc89057fa9b33dbf9a20c1d0800146f05a28bbad527ed2a836c2fa4e2d3

Analysis

Target

List of our purchase order.exe
Size

1.1MB
MD5

94c591351a9f0c0e8c61ee32b1e4bed8
SHA1

37c19b86622d1a9725a87c288af816aadda575a2
SHA256

017f433a49afcc765c5a5e7f39de6251fbe37d9c98f7d86f1abcefb1a9f559bc
SHA512

1b768f633f2d748a59a967f767eec9300e467163fc907b65c4b520c538bfeb89b7f957a566b365bce813ef9d47eb6e1372e3451b4527a62e37e9dcd30f4c0241

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

List of our purchase order.exe

description	pid	process	target process
PID 4908 wrote to memory of 4628	4908	List of our purchase order.exe	ieinstal.exe
PID 4908 wrote to memory of 4628	4908	List of our purchase order.exe	ieinstal.exe
PID 4908 wrote to memory of 4628	4908	List of our purchase order.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\List of our purchase order.exe
"C:\Users\Admin\AppData\Local\Temp\List of our purchase order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:4628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact