Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order list.JPG.scr
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Purchase order list.JPG.scr
Resource
win10v2004-20240508-en
General
-
Target
Purchase order list.JPG.scr
-
Size
674KB
-
MD5
732666aebcfaa043adcf0435c25c2a63
-
SHA1
7063a25f0d956ac54fdf83b5842f750c18d214e7
-
SHA256
1a5f70e81feddef080a6913baa2c46e2098cc0dec52c66a0f6632084d7ba983e
-
SHA512
0d0eb7aaa8c0033e3e6e84316eb3b095b47cfea00c8e8adcc12525f628966e8de39e891bb6f55de8991536912fe746fd6f27892c4aa0fbacc9842295714dce79
-
SSDEEP
12288:S5ciWsuCCFz+srS6lBeMS8YOUKaENFgI9ttuZC7vWEY:STMFCO5lmOUKaXINuK2
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Purchase order list.JPG.scrdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe Purchase order list.JPG.scr File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe Purchase order list.JPG.scr -
Executes dropped EXE 4 IoCs
Processes:
example.exeexample.exeexample.exeexample.exepid process 2704 example.exe 2408 example.exe 2784 example.exe 1228 example.exe -
Loads dropped DLL 7 IoCs
Processes:
Purchase order list.JPG.scrdw20.exedw20.exepid process 1624 Purchase order list.JPG.scr 1568 dw20.exe 1568 dw20.exe 1568 dw20.exe 2088 dw20.exe 2088 dw20.exe 2088 dw20.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
example.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\example = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\example.exe" example.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase order list.JPG.screxample.exeexample.exedescription pid process target process PID 1624 set thread context of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 2704 set thread context of 2408 2704 example.exe example.exe PID 2784 set thread context of 1228 2784 example.exe example.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Purchase order list.JPG.screxample.exeexample.exepid process 1624 Purchase order list.JPG.scr 1624 Purchase order list.JPG.scr 1624 Purchase order list.JPG.scr 2704 example.exe 2704 example.exe 2704 example.exe 2784 example.exe 2784 example.exe 2784 example.exe 2784 example.exe 2784 example.exe 2704 example.exe 2704 example.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
dw20.exedw20.exepid process 2128 dw20.exe 1568 dw20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase order list.JPG.screxample.exeexample.exedescription pid process Token: SeDebugPrivilege 1624 Purchase order list.JPG.scr Token: SeDebugPrivilege 2704 example.exe Token: SeDebugPrivilege 2784 example.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
Purchase order list.JPG.screxample.exeexample.exePurchase order list.JPG.screxample.exeexample.exedescription pid process target process PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2552 1624 Purchase order list.JPG.scr Purchase order list.JPG.scr PID 1624 wrote to memory of 2704 1624 Purchase order list.JPG.scr example.exe PID 1624 wrote to memory of 2704 1624 Purchase order list.JPG.scr example.exe PID 1624 wrote to memory of 2704 1624 Purchase order list.JPG.scr example.exe PID 1624 wrote to memory of 2704 1624 Purchase order list.JPG.scr example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2408 2704 example.exe example.exe PID 2704 wrote to memory of 2784 2704 example.exe example.exe PID 2704 wrote to memory of 2784 2704 example.exe example.exe PID 2704 wrote to memory of 2784 2704 example.exe example.exe PID 2704 wrote to memory of 2784 2704 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2784 wrote to memory of 1228 2784 example.exe example.exe PID 2552 wrote to memory of 2128 2552 Purchase order list.JPG.scr dw20.exe PID 2552 wrote to memory of 2128 2552 Purchase order list.JPG.scr dw20.exe PID 2552 wrote to memory of 2128 2552 Purchase order list.JPG.scr dw20.exe PID 2552 wrote to memory of 2128 2552 Purchase order list.JPG.scr dw20.exe PID 2408 wrote to memory of 1568 2408 example.exe dw20.exe PID 2408 wrote to memory of 1568 2408 example.exe dw20.exe PID 2408 wrote to memory of 1568 2408 example.exe dw20.exe PID 2408 wrote to memory of 1568 2408 example.exe dw20.exe PID 1228 wrote to memory of 2088 1228 example.exe dw20.exe PID 1228 wrote to memory of 2088 1228 example.exe dw20.exe PID 1228 wrote to memory of 2088 1228 example.exe dw20.exe PID 1228 wrote to memory of 2088 1228 example.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase order list.JPG.scr"C:\Users\Admin\AppData\Local\Temp\Purchase order list.JPG.scr" /S1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order list.JPG.scr"C:\Users\Admin\AppData\Local\Temp\Purchase order list.JPG.scr"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7643⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7644⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7725⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.exeFilesize
674KB
MD5732666aebcfaa043adcf0435c25c2a63
SHA17063a25f0d956ac54fdf83b5842f750c18d214e7
SHA2561a5f70e81feddef080a6913baa2c46e2098cc0dec52c66a0f6632084d7ba983e
SHA5120d0eb7aaa8c0033e3e6e84316eb3b095b47cfea00c8e8adcc12525f628966e8de39e891bb6f55de8991536912fe746fd6f27892c4aa0fbacc9842295714dce79
-
memory/1624-0-0x0000000074951000-0x0000000074952000-memory.dmpFilesize
4KB
-
memory/1624-1-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/1624-2-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/1624-3-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/1624-19-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/2552-6-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2552-9-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/2552-10-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/2552-11-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/2552-8-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2552-4-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2552-35-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB