01c14141de498613ffa06f2ea96bba8ff387aacab8b5a202498a267f2b564b07

General

Target

Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
Size

808KB
MD5

281764c2fad863a9358661d39751585e
SHA1

5c2a080b4da15db472f636c5ae8713dd68591be4
SHA256

01c14141de498613ffa06f2ea96bba8ff387aacab8b5a202498a267f2b564b07
SHA512

3422c035c6e52ed5abbed00cb98a05935d04f3a07ca82b9f5e26a3bbdc28fe925a38b8468ab7417d09d3cb768a2c663dc58438b106fb0d7115a956f1fda697ed
SSDEEP

24576:YJ7bRJYBQkxRwqXRk+Qem6NrFcDSnAsQC:MxkMSWScDSAI

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 2616 set thread context of 1104	2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	20
PID 2616 set thread context of 2472	2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	31
PID 2472 set thread context of 1104	2472	SyncHost.exe	20

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe
2472	SyncHost.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2616	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
1104	Explorer.EXE
1104	Explorer.EXE
2472	SyncHost.exe
2472	SyncHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1912 wrote to memory of 2616	1912	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	28
PID 1104 wrote to memory of 2472	1104	Explorer.EXE	31
PID 1104 wrote to memory of 2472	1104	Explorer.EXE	31
PID 1104 wrote to memory of 2472	1104	Explorer.EXE	31
PID 1104 wrote to memory of 2472	1104	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\Order confirmation F20 - 011 PURCHASE ORDER.scr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\Order confirmation F20 - 011 PURCHASE ORDER.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\Order confirmation F20 - 011 PURCHASE ORDER.scr.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2616
- C:\Windows\SysWOW64\SyncHost.exe
  "C:\Windows\SysWOW64\SyncHost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-30-0x0000000009160000-0x000000000C348000-memory.dmp

Filesize
49.9MB

Download
memory/1104-22-0x0000000009160000-0x000000000C348000-memory.dmp

Filesize
49.9MB

Download
memory/1912-16-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1912-1-0x00000000011D0000-0x00000000012A0000-memory.dmp

Filesize
832KB

Download
memory/1912-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1912-3-0x00000000003B0000-0x00000000003CE000-memory.dmp

Filesize
120KB

Download
memory/1912-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1912-5-0x00000000004A0000-0x00000000004B6000-memory.dmp

Filesize
88KB

Download
memory/1912-6-0x0000000007CF0000-0x0000000007D7A000-memory.dmp

Filesize
552KB

Download
memory/1912-7-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/1912-8-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1912-0-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/2472-24-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2472-23-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2472-31-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2472-29-0x00000000009A0000-0x0000000000A3B000-memory.dmp

Filesize
620KB

Download
memory/2472-28-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2472-27-0x0000000002020000-0x0000000002323000-memory.dmp

Filesize
3.0MB

Download
memory/2616-21-0x0000000000190000-0x00000000001AC000-memory.dmp

Filesize
112KB

Download
memory/2616-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-26-0x0000000000190000-0x00000000001AC000-memory.dmp

Filesize
112KB

Download
memory/2616-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-17-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing