Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 14:24
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order 50048205_JPG.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Purchase order 50048205_JPG.exe
Resource
win10v2004-20220901-en
General
-
Target
Purchase order 50048205_JPG.exe
-
Size
689KB
-
MD5
ceba3a31aeda8eea8efc26bb787ec690
-
SHA1
b3a8b39e8438984ba680fe597df728940ed09a66
-
SHA256
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406
-
SHA512
139ce4a7e0fc91450beb6ab7a29711081db0e033902b5c385bc6408e65dbbcbd35e0621bdd4c2010ff15e91a818311f314d4f15e8f5d636e9d9994f3922a7e5f
-
SSDEEP
12288:2cMkhWAEQ0J6rpEretKUjQ0kKSMtpSe2Tahcjd/1FhUxsBPGtVppPNF:czQ0J+EreVFkKSekehm/1FuxsetrhX
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Purchase order 50048205_JPG.execaspol.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Purchase order 50048205_JPG.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe -
Loads dropped DLL 1 IoCs
Processes:
Purchase order 50048205_JPG.exepid process 1764 Purchase order 50048205_JPG.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Purchase order 50048205_JPG.execaspol.exepid process 1764 Purchase order 50048205_JPG.exe 788 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase order 50048205_JPG.exedescription pid process target process PID 1764 set thread context of 788 1764 Purchase order 50048205_JPG.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Purchase order 50048205_JPG.exepid process 1764 Purchase order 50048205_JPG.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Purchase order 50048205_JPG.exedescription pid process target process PID 1764 wrote to memory of 788 1764 Purchase order 50048205_JPG.exe caspol.exe PID 1764 wrote to memory of 788 1764 Purchase order 50048205_JPG.exe caspol.exe PID 1764 wrote to memory of 788 1764 Purchase order 50048205_JPG.exe caspol.exe PID 1764 wrote to memory of 788 1764 Purchase order 50048205_JPG.exe caspol.exe PID 1764 wrote to memory of 788 1764 Purchase order 50048205_JPG.exe caspol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstCEE.tmp\System.dllFilesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
memory/788-62-0x000000000123768E-mapping.dmp
-
memory/788-70-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/788-69-0x0000000001240000-0x00000000029C6000-memory.dmpFilesize
23.5MB
-
memory/788-64-0x0000000077170000-0x0000000077319000-memory.dmpFilesize
1.7MB
-
memory/788-63-0x0000000001240000-0x00000000029C6000-memory.dmpFilesize
23.5MB
-
memory/1764-57-0x0000000003780000-0x0000000004F06000-memory.dmpFilesize
23.5MB
-
memory/1764-60-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/1764-58-0x0000000077170000-0x0000000077319000-memory.dmpFilesize
1.7MB
-
memory/1764-67-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/1764-68-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/1764-54-0x0000000074E61000-0x0000000074E63000-memory.dmpFilesize
8KB
-
memory/1764-56-0x0000000003780000-0x0000000004F06000-memory.dmpFilesize
23.5MB
-
memory/1764-71-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB