a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d | Triage

Analysis

max time kernel
113s
max time network
119s
platform
windows7_x64
resource
win7
submitted
16/07/2020, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

New Order.exe
Size

703KB
MD5

cb1e5100178e01e87e62c31c97b95f1e
SHA1

726effacd1070764db731f93dbb9f4f4b0320231
SHA256

a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d
SHA512

906b144bdf44dd54e5562325b713261d7079f053ef3c8e552b5c3371412a4e21dfef4380ca3ef56910ebb7837d1a85bca5c36a6d9cbda68a163b81da346aba59

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1452	1060	New Order.exe	24
PID 1060 wrote to memory of 1452	1060	New Order.exe	24
PID 1060 wrote to memory of 1452	1060	New Order.exe	24
PID 1060 wrote to memory of 1452	1060	New Order.exe	24
PID 1452 wrote to memory of 888	1452	cmd.exe	26
PID 1452 wrote to memory of 888	1452	cmd.exe	26
PID 1452 wrote to memory of 888	1452	cmd.exe	26
PID 1452 wrote to memory of 888	1452	cmd.exe	26
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28
PID 1060 wrote to memory of 1108	1060	New Order.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1108	rundll32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	New Order.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1060	New Order.exe
1060	New Order.exe
1060	New Order.exe

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Payment details /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\Payment details"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Payment details /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\Payment details"
    3⤵
    PID:888
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\Payment details
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Modifies registry class
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads