Analysis
- max time kernel
143s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
15/05/2023, 16:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Purchase Order 008763.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase Order 008763.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Purchase Order 008763.exe
- Size 1.4MB
- Sample230515-tkmsxaef9w
- SHA256 b3e72bd956725985380cf910a04d72e6c51758d3924dccc9284bdca439748d6d
- MD5 1d4bfee4503e00b67792b4cccd63c1d4
- SHA1 7ddeee8888b1f6497dc14ed0606b11a737927190
- SHA512 6b65389b6080985333964fb9af770c396fe2cf5062be8657a7b38cb67c3df6d98e0dfb4eff773a82776d26c63e9df37e25bc9e31fb7dd2ae364d4e1b619aadfe
- SSDEEP 12288:J2+89C1RdgumV6fuNZE4goNnbzBcwbcDEE1p1qhfzX+DWT5F/oHT70EqJI108sYG:v3uz7cGEeYrVCnUKrcDeZh5ti5I7d
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2580 set thread context of 3588 2580 Purchase Order 008763.exe 91 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 2580 Purchase Order 008763.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe 3588 AddInProcess32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2580 Purchase Order 008763.exe Token: SeDebugPrivilege 3588 AddInProcess32.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2580 wrote to memory of 408 2580 Purchase Order 008763.exe 83 PID 2580 wrote to memory of 408 2580 Purchase Order 008763.exe 83 PID 2580 wrote to memory of 2020 2580 Purchase Order 008763.exe 84 PID 2580 wrote to memory of 2020 2580 Purchase Order 008763.exe 84 PID 2580 wrote to memory of 2184 2580 Purchase Order 008763.exe 85 PID 2580 wrote to memory of 2184 2580 Purchase Order 008763.exe 85 PID 2580 wrote to memory of 3408 2580 Purchase Order 008763.exe 86 PID 2580 wrote to memory of 3408 2580 Purchase Order 008763.exe 86 PID 2580 wrote to memory of 4280 2580 Purchase Order 008763.exe 87 PID 2580 wrote to memory of 4280 2580 Purchase Order 008763.exe 87 PID 2580 wrote to memory of 4288 2580 Purchase Order 008763.exe 88 PID 2580 wrote to memory of 4288 2580 Purchase Order 008763.exe 88 PID 2580 wrote to memory of 3904 2580 Purchase Order 008763.exe 89 PID 2580 wrote to memory of 3904 2580 Purchase Order 008763.exe 89 PID 2580 wrote to memory of 5048 2580 Purchase Order 008763.exe 90 PID 2580 wrote to memory of 5048 2580 Purchase Order 008763.exe 90 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91 PID 2580 wrote to memory of 3588 2580 Purchase Order 008763.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 008763.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 008763.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:2020
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2184
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:3408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:4280
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:4288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:3904
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:5048
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-