Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PURCHASE ORDER # 12076038 & 12076022.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.515567629788117
Filename:	PURCHASE ORDER # 12076038 & 12076022.exe
Filesize:	918528
MD5:	152c62372d3ea07d023e1e187766fd4b
SHA1:	32b630bc22b63d7eee42851175ebe43a13a92c15
SHA256:	b3e12ecdee9eacc7354a7d43ccd3ebe7e6db207e93f73b7a847ff4bee9f27f86
SHA512:	cde084b3ad2e0e7068b4e48d7a58f1173d17bd297a95f3c4af7ee104a80e3d9189d93877f044d652de42f13d6e6c446be97fc2c74d4ae857e93a10f84c68dce7
SSDEEP:	24576:A7mvLPt69/L1tmzf5LzjG1Vq5p73+KXGUInp:Di/L1t8F61VqP3+KC
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P......J......>.... ........@.. .......................`............@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
.NET source code references suspicious native API functions	HIPS / PFW / Operating System Protection Evasion	Native API
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Encrypted Channel
Creates processes with suspicious names	Persistence and Installation Behavior
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Sample file is different than original file name gathered from version info	System Summary
Drops PE files	Persistence and Installation Behavior
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Found malware configuration	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Uses an in-process (OLE) Automation server	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Reads ini files	System Summary	File and Directory Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER # 12076038 & 12076022.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER # 12076038 & 12076022.exe.log
Category:	dropped
Dump:	PURCHASE ORDER # 12076038 & 12076022.exe.log.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER # 12076038 & 12076022.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
Size:	1216
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\tmp778D.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\tmp778D.tmp
Category:	dropped
Dump:	tmp778D.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER # 12076038 & 12076022.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.197464487238917
Encrypted:	false
Ssdeep:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgetn:cbh47TlNQ//rydbz9I3YODOLNdq3aY
Size:	1645
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Scheduled temp file as task from temp location	Persistence and Installation Behavior
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\WytzFSULZWRc.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\WytzFSULZWRc.exe
Category:	dropped
Dump:	WytzFSULZWRc.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER # 12076038 & 12076022.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.515567629788117
Encrypted:	false
Ssdeep:	24576:A7mvLPt69/L1tmzf5LzjG1Vq5p73+KXGUInp:Di/L1t8F61VqP3+KC
Size:	918528
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe
Category:	dropped
Dump:	zBwkauB.exe.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.149629800481177
Encrypted:	false
Ssdeep:	768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
Size:	45152
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WytzFSULZWRc.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WytzFSULZWRc.exe.log
Category:	dropped
Dump:	WytzFSULZWRc.exe.log.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Users\user\AppData\Roaming\WytzFSULZWRc.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
Size:	1216
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zBwkauB.exe.log

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zBwkauB.exe.log
Category:	modified
Dump:	zBwkauB.exe.log.14.dr
ID:	dr_7
Target ID:	14
Process:	C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.090621108356562
Encrypted:	false
Ssdeep:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
Size:	142
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\tmpF325.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\tmpF325.tmp
Category:	dropped
Dump:	tmpF325.tmp.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Users\user\AppData\Roaming\WytzFSULZWRc.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.197464487238917
Encrypted:	false
Ssdeep:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgetn:cbh47TlNQ//rydbz9I3YODOLNdq3aY
Size:	1645
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.16.dr
ID:	dr_8
Target ID:	16
Process:	C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.44831826838854
Encrypted:	false
Ssdeep:	24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
Size:	1141
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\PURCHASE ORDER # 12076038 & 12076022.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WytzFSULZWRc" /XML "C:\Users\user\AppData\Local\Temp\tmp778D.tmp

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

C:\Users\user\AppData\Roaming\WytzFSULZWRc.exe

C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe

"C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe

"C:\Users\user\AppData\Roaming\zBwkauB\zBwkauB.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WytzFSULZWRc" /XML "C:\Users\user\AppData\Local\Temp\tmpF325.tmp

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

There are 3 hidden processes, click here to show them.

URLs

Name

Malicious

http://127.0.0.1:HTTP/1.1

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.fontbureau.com/designersG

unknown

http://sWLumX.com

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://www.goodfont.co.kr

unknown

http://en.w

unknown

http://www.carterandcone.coml

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://fontfabrik.com

unknown

http://www.founder.com.cn/cn

unknown

https://3NOOLBR7kS.org

unknown

http://www.fontbureau.com/designers/frere-jones.html

unknown

http://dmstech.in

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://DynDns.comDynDNSnamejidpasswordPsi/Psi

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.fontbureau.com/designers8

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://mail.dmstech.in

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
PURCHASE ORDER # 12076038 & 12076022.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPURCHASE ORDER # 12076038 & 12076022.exe

Files

Processes

URLs

IOC Report
PURCHASE ORDER # 12076038 & 12076022.exe