Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
Purchase_Order.exe
Resource
win7-20220812-en
General
-
Target
Purchase_Order.exe
-
Size
298KB
-
MD5
bbb57513bb805fcb3ef1ae2391471599
-
SHA1
66c7d14b225a33b350e6f67a38d083ae019b4169
-
SHA256
f3d069895a8e65723f90f6ea33a53b6b30cdb20a613ae18292780f610eccd03e
-
SHA512
26e427a38cff46ba25d5b71c82c4ead15cb7f50c1f2ed4ba4f86ae7c42d8af6b91de3c16521d25c56033735ae1ef64d1d80a5c66c2cafcef20552a1576c1531e
-
SSDEEP
6144:Ze7CeGzLGQ6pFxwXP1Rtg6il224AAUr2A1wdkKhaTMiM:euzLGQ6eXP1Rtv24AhLG1
Malware Config
Extracted
formbook
i65a
r00zzvD9uoqMkFT8XDSqPg==
iSMQDJ3Tyuj8KXflBw==
Gq+tYoFrGU/5B4gGNnzHNg==
wEwcynSwpynZKUFhqyIK
bw3PbrjowhAVJA==
TggEt9LuwhAVJA==
r0UqC6sxgcWN7vc=
0m+fwBgf0oyehByUtx51BsBkuj8=
dhtdWWyIhRatp2dpv8tPcJoQ
jTAw4/4TCwcXjpECXDSqPg==
aglx4nPPkGp/raeivGVOfzdbFIu4
+qXr4cAGtQJm7Mf6
sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=
E6ohOo2zadVgzLIfaWALaik=
wXwu0yo/KbNm7Mf6
EcoyojCJYKg1laCuBK+exkNbFIu4
bhZgFvj6yP+R4F+0/5S/oFMpAA==
rzlylCB1NIMabG2dzGQd
+5ngCKjwwhAVJA==
AMUtZrYh+0LPL/QyfSo=
hzqw1O4JApAae41vjXUOeC8=
C7guqfg0PD5dvVf4DQ==
BsM1AaksgMWN7vc=
5pcGLkVbBUPPL/QyfSo=
TvMO/UKDdcWN7vc=
fCNJYrrKfTprvVf4DQ==
5rfNvNbPhEFrvVf4DQ==
9717JcIR+w4iNgKcr91It5f448HcIA==
Wfo2UPQmr3SeAgqCx+ihjjsY
Svg8XfRAHZ5DvXj4EA==
TuXg5TNpdh6yCOmt0pkeNaKCuzc=
fjn46QYnKM4w0+g=
WRV/AkxH/M7NzFzkCw91Zpz048HcIA==
Bo6ILlHigRGpGJRgtPd6WQFsGA==
ZCdTYvhSBMTjO0mpy+ihjjsY
Vg104XmxSn8DTRA2YCA=
fBmNxO/pwkHXAKalv3UOeC8=
2YL6LEtrcsyquo2wz3ahjjsY
iC2cyuTQsS3KHymco5LiuXXRdYc9KA==
JvGrI2XdqxWjoPQyfSo=
NMuVRIiBW1Nhjn9zgw3PwEJbFIu4
7KsjVqn0meiO7MVyjXUOeC8=
XvgsVPgmHCtBPPXC7IhcycBkuj8=
HsE0cZF7K+0KXVC4yexV8KqiJAA0Yi8=
ZA9olK7JxkTg6q7/TenoBXFnljPD7XGx
PvN6Nk9THuEFRZYCFA==
cx/LcM3luPqVmxJ+jhMI
smWwq8nUo09jvVf4DQ==
aBnnX3Z7RIQqQsRdhz0=
8o1CKXiwmgZm7Mf6
s2NR7g0vRFBRp3VhqyIK
DLYGcptChcWN7vc=
0GEVmuU0F1jkMfQyfSo=
s1Kiy26yq6+H9spyinUOeC8=
CZxV2PHhkdRu/ewuGg==
y8Xu3/EguTvj
ulTCKLYf9ULaNPQyfSo=
1Yl0JHHbnlR3eAp4uepO8u5YFRkKjVNu8Q==
V+zu64nHc059gzjoEtXhkxEB
dQkau9PuwhAVJA==
NMYypu3zqoGsllajzOShjjsY
Wxkhx+n/zcWN7vc=
74dZAaju4XcRfFR3kzM=
u3R6gBVPPDpcvVf4DQ==
partnermdg.com
Extracted
xloader
3.8
i65a
r00zzvD9uoqMkFT8XDSqPg==
iSMQDJ3Tyuj8KXflBw==
Gq+tYoFrGU/5B4gGNnzHNg==
wEwcynSwpynZKUFhqyIK
bw3PbrjowhAVJA==
TggEt9LuwhAVJA==
r0UqC6sxgcWN7vc=
0m+fwBgf0oyehByUtx51BsBkuj8=
dhtdWWyIhRatp2dpv8tPcJoQ
jTAw4/4TCwcXjpECXDSqPg==
aglx4nPPkGp/raeivGVOfzdbFIu4
+qXr4cAGtQJm7Mf6
sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=
E6ohOo2zadVgzLIfaWALaik=
wXwu0yo/KbNm7Mf6
EcoyojCJYKg1laCuBK+exkNbFIu4
bhZgFvj6yP+R4F+0/5S/oFMpAA==
rzlylCB1NIMabG2dzGQd
+5ngCKjwwhAVJA==
AMUtZrYh+0LPL/QyfSo=
hzqw1O4JApAae41vjXUOeC8=
C7guqfg0PD5dvVf4DQ==
BsM1AaksgMWN7vc=
5pcGLkVbBUPPL/QyfSo=
TvMO/UKDdcWN7vc=
fCNJYrrKfTprvVf4DQ==
5rfNvNbPhEFrvVf4DQ==
9717JcIR+w4iNgKcr91It5f448HcIA==
Wfo2UPQmr3SeAgqCx+ihjjsY
Svg8XfRAHZ5DvXj4EA==
TuXg5TNpdh6yCOmt0pkeNaKCuzc=
fjn46QYnKM4w0+g=
WRV/AkxH/M7NzFzkCw91Zpz048HcIA==
Bo6ILlHigRGpGJRgtPd6WQFsGA==
ZCdTYvhSBMTjO0mpy+ihjjsY
Vg104XmxSn8DTRA2YCA=
fBmNxO/pwkHXAKalv3UOeC8=
2YL6LEtrcsyquo2wz3ahjjsY
iC2cyuTQsS3KHymco5LiuXXRdYc9KA==
JvGrI2XdqxWjoPQyfSo=
NMuVRIiBW1Nhjn9zgw3PwEJbFIu4
7KsjVqn0meiO7MVyjXUOeC8=
XvgsVPgmHCtBPPXC7IhcycBkuj8=
HsE0cZF7K+0KXVC4yexV8KqiJAA0Yi8=
ZA9olK7JxkTg6q7/TenoBXFnljPD7XGx
PvN6Nk9THuEFRZYCFA==
cx/LcM3luPqVmxJ+jhMI
smWwq8nUo09jvVf4DQ==
aBnnX3Z7RIQqQsRdhz0=
8o1CKXiwmgZm7Mf6
s2NR7g0vRFBRp3VhqyIK
DLYGcptChcWN7vc=
0GEVmuU0F1jkMfQyfSo=
s1Kiy26yq6+H9spyinUOeC8=
CZxV2PHhkdRu/ewuGg==
y8Xu3/EguTvj
ulTCKLYf9ULaNPQyfSo=
1Yl0JHHbnlR3eAp4uepO8u5YFRkKjVNu8Q==
V+zu64nHc059gzjoEtXhkxEB
dQkau9PuwhAVJA==
NMYypu3zqoGsllajzOShjjsY
Wxkhx+n/zcWN7vc=
74dZAaju4XcRfFR3kzM=
u3R6gBVPPDpcvVf4DQ==
partnermdg.com
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 1236 help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase_Order.exeaspnet_compiler.exehelp.exedescription pid process target process PID 900 set thread context of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 1472 set thread context of 1192 1472 aspnet_compiler.exe Explorer.EXE PID 1236 set thread context of 1192 1236 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
aspnet_compiler.exehelp.exepid process 1472 aspnet_compiler.exe 1472 aspnet_compiler.exe 1472 aspnet_compiler.exe 1472 aspnet_compiler.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
aspnet_compiler.exehelp.exepid process 1472 aspnet_compiler.exe 1472 aspnet_compiler.exe 1472 aspnet_compiler.exe 1236 help.exe 1236 help.exe 1236 help.exe 1236 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aspnet_compiler.exehelp.exedescription pid process Token: SeDebugPrivilege 1472 aspnet_compiler.exe Token: SeDebugPrivilege 1236 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Purchase_Order.exeExplorer.EXEhelp.exedescription pid process target process PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 900 wrote to memory of 1472 900 Purchase_Order.exe aspnet_compiler.exe PID 1192 wrote to memory of 1236 1192 Explorer.EXE help.exe PID 1192 wrote to memory of 1236 1192 Explorer.EXE help.exe PID 1192 wrote to memory of 1236 1192 Explorer.EXE help.exe PID 1192 wrote to memory of 1236 1192 Explorer.EXE help.exe PID 1236 wrote to memory of 1868 1236 help.exe Firefox.exe PID 1236 wrote to memory of 1868 1236 help.exe Firefox.exe PID 1236 wrote to memory of 1868 1236 help.exe Firefox.exe PID 1236 wrote to memory of 1868 1236 help.exe Firefox.exe PID 1236 wrote to memory of 1868 1236 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase_Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase_Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
895KB
MD51eb6acf76a15b74b38333af47dc1218d
SHA1a3fbc817f59b6a8899dc338cc15a75cdd17dfff1
SHA256a5ef3a78eb333b0e6dca194ea711dcbb036119a788ecfe125f05176fb0fb70a3
SHA512717931aa928de150abbb70d523c7dbd472bfa6c511ab55e0b50df8d9661d33635156ed7b750285fa383cdd4064f225ea022f0bead3e066ee2beba84ef5731c15
-
memory/900-55-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/900-56-0x0000000000520000-0x0000000000526000-memory.dmpFilesize
24KB
-
memory/900-57-0x0000000000580000-0x000000000058C000-memory.dmpFilesize
48KB
-
memory/900-58-0x0000000000590000-0x0000000000598000-memory.dmpFilesize
32KB
-
memory/900-54-0x0000000000C50000-0x0000000000C9C000-memory.dmpFilesize
304KB
-
memory/1192-76-0x0000000004CF0000-0x0000000004E16000-memory.dmpFilesize
1.1MB
-
memory/1192-79-0x0000000004CF0000-0x0000000004E16000-memory.dmpFilesize
1.1MB
-
memory/1192-70-0x0000000004EA0000-0x0000000005002000-memory.dmpFilesize
1.4MB
-
memory/1236-78-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1236-77-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1236-75-0x0000000000580000-0x000000000060F000-memory.dmpFilesize
572KB
-
memory/1236-74-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1236-73-0x0000000000690000-0x0000000000993000-memory.dmpFilesize
3.0MB
-
memory/1236-72-0x0000000000A00000-0x0000000000A06000-memory.dmpFilesize
24KB
-
memory/1236-71-0x0000000000000000-mapping.dmp
-
memory/1472-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1472-69-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/1472-68-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1472-67-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1472-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1472-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1472-63-0x00000000004012B0-mapping.dmp
-
memory/1472-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1472-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB