a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d | Triage

Analysis

max time kernel
113s
max time network
119s
platform
windows7_x64
resource
win7
submitted
16-07-2020 00:57

Sharing

Report Analysis Logs

General

Target

New Order.exe
Size

703KB
MD5

cb1e5100178e01e87e62c31c97b95f1e
SHA1

726effacd1070764db731f93dbb9f4f4b0320231
SHA256

a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d
SHA512

906b144bdf44dd54e5562325b713261d7079f053ef3c8e552b5c3371412a4e21dfef4380ca3ef56910ebb7837d1a85bca5c36a6d9cbda68a163b81da346aba59

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

New Order.execmd.exe

description	pid	process	target process
PID 1060 wrote to memory of 1452	1060	New Order.exe	cmd.exe
PID 1060 wrote to memory of 1452	1060	New Order.exe	cmd.exe
PID 1060 wrote to memory of 1452	1060	New Order.exe	cmd.exe
PID 1060 wrote to memory of 1452	1060	New Order.exe	cmd.exe
PID 1452 wrote to memory of 888	1452	cmd.exe	reg.exe
PID 1452 wrote to memory of 888	1452	cmd.exe	reg.exe
PID 1452 wrote to memory of 888	1452	cmd.exe	reg.exe
PID 1452 wrote to memory of 888	1452	cmd.exe	reg.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe
PID 1060 wrote to memory of 1108	1060	New Order.exe	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1108 rundll32.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

New Order.exe

description pid process

Token: SeDebugPrivilege 1060 New Order.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

New Order.exe

pid process

1060 New Order.exe
1060 New Order.exe
1060 New Order.exe

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Payment details /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\Payment details"
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Payment details /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\Payment details"
3⤵
PID:888

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\Payment details
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Modifies registry class
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-4-0x0000000000000000-mapping.dmp

Download
memory/1060-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1108-5-0x0000000000000000-mapping.dmp

Download
memory/1452-3-0x0000000000000000-mapping.dmp

Download