Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New Purchase Order Document for PO1136908 000 SE.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
New Purchase Order Document for PO1136908 000 SE.exe
-
Size
7.1MB
-
MD5
9b2c361b77d2a5198602a24b473b506a
-
SHA1
01a4beda7991a7d5ad9717e25e3d47d219dec1f9
-
SHA256
9ebb6978d40e7e5870ee40d426ccc6cf7eff686b5d95375399c6d15388067f0d
-
SHA512
3fb44a807dc6bc1aaf97f7a39b06a870d1f8d19429cd699b1839ee4233d1267ab3fac535255b49d07d32937e79df888c1e75c52a725405b416ed99236465741e
-
SSDEEP
98304:YlaHVJHFOv9GJ6RiiOPriSL+pMI6cNKu4X2XfQ9rr6YrxV:ZHzFOvcOS0MRcNz4mI9qYtV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5904 2020 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Purchase Order Document for PO1136908 000 SE.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2020 New Purchase Order Document for PO1136908 000 SE.exe 2020 New Purchase Order Document for PO1136908 000 SE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2020 New Purchase Order Document for PO1136908 000 SE.exe Token: SeDebugPrivilege 2020 New Purchase Order Document for PO1136908 000 SE.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 5904 2020 New Purchase Order Document for PO1136908 000 SE.exe 30 PID 2020 wrote to memory of 5904 2020 New Purchase Order Document for PO1136908 000 SE.exe 30 PID 2020 wrote to memory of 5904 2020 New Purchase Order Document for PO1136908 000 SE.exe 30 PID 2020 wrote to memory of 5904 2020 New Purchase Order Document for PO1136908 000 SE.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Order Document for PO1136908 000 SE.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Order Document for PO1136908 000 SE.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 8722⤵
- Program crash
PID:5904
-