Analysis
- max time kernel
148s - max time network
141s - platform
windows10_x64 - resource
win10v200430 - submitted
06/07/2020, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
ORDER.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ORDER.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target ORDER.exe
- Size 353KB
- Sample200706-krsgrfbx8x
- SHA256 7a8db6a831edc72a1811ed42f3f0ce72ccb93455284b65dbc374a4298eee52f2
- MD5 3838d27bbe79466f84455fff8a22ebb4
- SHA1 98e95cb61dd9bf772a9ac2d7592148ae50c511be
- SHA512 7108d8fa45ce8cb65f3797dc694ac3ade2771c5be16c889d954b19b796b4d32c439a63fc34480f83ac8d39901981821b78bcf832e33ff0bbd8c8150ac9ab4ef0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1612 set thread context of 2484 1612 ORDER.exe 72 PID 2484 set thread context of 3024 2484 ORDER.exe 56 PID 2704 set thread context of 3024 2704 cscript.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2484 ORDER.exe 2484 ORDER.exe 2484 ORDER.exe 2484 ORDER.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZDML6TEHHJ = "C:\\Program Files (x86)\\Pzn9l_rrx\\systraygrk.exe" cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Pzn9l_rrx\systraygrk.exe cscript.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 1612 wrote to memory of 2484 1612 ORDER.exe 72 PID 3024 wrote to memory of 2704 3024 Explorer.EXE 73 PID 3024 wrote to memory of 2704 3024 Explorer.EXE 73 PID 3024 wrote to memory of 2704 3024 Explorer.EXE 73 PID 2704 wrote to memory of 3784 2704 cscript.exe 74 PID 2704 wrote to memory of 3784 2704 cscript.exe 74 PID 2704 wrote to memory of 3784 2704 cscript.exe 74 PID 2704 wrote to memory of 3728 2704 cscript.exe 76 PID 2704 wrote to memory of 3728 2704 cscript.exe 76 PID 2704 wrote to memory of 3728 2704 cscript.exe 76 PID 2704 wrote to memory of 3836 2704 cscript.exe 78 PID 2704 wrote to memory of 3836 2704 cscript.exe 78 PID 2704 wrote to memory of 3836 2704 cscript.exe 78 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2484 ORDER.exe Token: SeDebugPrivilege 2704 cscript.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2484 ORDER.exe 2484 ORDER.exe 2484 ORDER.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe 2704 cscript.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2484
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- System policy modification
PID:2704 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER.exe"3⤵PID:3784
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3728
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3836
-
-