Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Purchase order.exe
Resource
win10v2004-20220721-en
General
-
Target
Purchase order.exe
-
Size
884KB
-
MD5
c0ca159ecfd86c426acfa99e7255f874
-
SHA1
1e8b2344a0252db75e9a106111e89d844639cb62
-
SHA256
aae89af9bf54cc3d9659631b9438942f192239e50eba6da7918ebced50c700c5
-
SHA512
353a5d40ff2df98fb9d0442bb18f04e8c0a61c58f21bbb8192605d82089810607483faa8a8fc863bfa5602bd7a547142112105de21ae48854de4699696ad06ab
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Purchase order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Purchase order.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase order.exePurchase order.exesvchost.exedescription pid process target process PID 868 set thread context of 4140 868 Purchase order.exe Purchase order.exe PID 4140 set thread context of 2900 4140 Purchase order.exe Explorer.EXE PID 372 set thread context of 2900 372 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
Purchase order.exePurchase order.exesvchost.exepid process 868 Purchase order.exe 868 Purchase order.exe 868 Purchase order.exe 868 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe 372 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2900 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase order.exesvchost.exepid process 4140 Purchase order.exe 4140 Purchase order.exe 4140 Purchase order.exe 372 svchost.exe 372 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase order.exePurchase order.exesvchost.exedescription pid process Token: SeDebugPrivilege 868 Purchase order.exe Token: SeDebugPrivilege 4140 Purchase order.exe Token: SeDebugPrivilege 372 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase order.exeExplorer.EXEdescription pid process target process PID 868 wrote to memory of 4168 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4168 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4168 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4240 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4240 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4240 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 868 wrote to memory of 4140 868 Purchase order.exe Purchase order.exe PID 2900 wrote to memory of 372 2900 Explorer.EXE svchost.exe PID 2900 wrote to memory of 372 2900 Explorer.EXE svchost.exe PID 2900 wrote to memory of 372 2900 Explorer.EXE svchost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-147-0x0000000000AE0000-0x0000000000B0D000-memory.dmpFilesize
180KB
-
memory/372-148-0x0000000001600000-0x0000000001690000-memory.dmpFilesize
576KB
-
memory/372-146-0x0000000001700000-0x0000000001A4A000-memory.dmpFilesize
3.3MB
-
memory/372-143-0x0000000000000000-mapping.dmp
-
memory/372-145-0x0000000000A20000-0x0000000000A2E000-memory.dmpFilesize
56KB
-
memory/372-150-0x0000000000AE0000-0x0000000000B0D000-memory.dmpFilesize
180KB
-
memory/868-131-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/868-130-0x0000000000240000-0x0000000000324000-memory.dmpFilesize
912KB
-
memory/868-134-0x0000000004B90000-0x0000000004B9A000-memory.dmpFilesize
40KB
-
memory/868-133-0x0000000004D00000-0x0000000004D9C000-memory.dmpFilesize
624KB
-
memory/868-132-0x0000000004BA0000-0x0000000004C32000-memory.dmpFilesize
584KB
-
memory/2900-151-0x0000000002D60000-0x0000000002E26000-memory.dmpFilesize
792KB
-
memory/2900-149-0x0000000002D60000-0x0000000002E26000-memory.dmpFilesize
792KB
-
memory/2900-142-0x00000000032F0000-0x000000000343E000-memory.dmpFilesize
1.3MB
-
memory/4140-141-0x0000000001A00000-0x0000000001A11000-memory.dmpFilesize
68KB
-
memory/4140-144-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4140-140-0x0000000001A20000-0x0000000001D6A000-memory.dmpFilesize
3.3MB
-
memory/4140-138-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4140-137-0x0000000000000000-mapping.dmp
-
memory/4168-135-0x0000000000000000-mapping.dmp
-
memory/4240-136-0x0000000000000000-mapping.dmp