8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01

General

Target

8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe
Size

1.2MB
MD5

7e34c5bd27f25a1e1d47a27702708e28
SHA1

fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
SHA256

8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
SHA512

2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f

Score

9^/10

persistence discovery exploit ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

Order:binOrder.exe

pid process

1508 Order:bin
2000 Order.exe

pid	process
1508	Order:bin
2000	Order.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Order.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResumeInstall.png.easy2lock	Order.exe
File created	C:\Users\Admin\Pictures\UnpublishGet.png.easy2lock_read_me	Order.exe
File renamed	C:\Users\Admin\Pictures\UnpublishGet.png => C:\Users\Admin\Pictures\UnpublishGet.png.easy2lock	Order.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishGet.png.easy2lock	Order.exe
File created	C:\Users\Admin\Pictures\ResumeInstall.png.easy2lock_read_me	Order.exe
File renamed	C:\Users\Admin\Pictures\ResumeInstall.png => C:\Users\Admin\Pictures\ResumeInstall.png.easy2lock	Order.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1628 takeown.exe
1936 icacls.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1348 cmd.exe

pid	process
1628	takeown.exe
1936	icacls.exe

pid	process
1348	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe

pid	process
900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe
900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1628 takeown.exe
1936 icacls.exe

pid	process
1628	takeown.exe
1936	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

Order:binattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Order.exe	Order:bin
File opened for modification	C:\Windows\SysWOW64\Order.exe	attrib.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1820 vssadmin.exe

pid	process
1820	vssadmin.exe

NTFS ADS 1 IoCs

Processes:

8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Order:bin	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1852 vssvc.exe
Token: SeRestorePrivilege 1852 vssvc.exe
Token: SeAuditPrivilege 1852 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1852	vssvc.exe
Token: SeRestorePrivilege	1852	vssvc.exe
Token: SeAuditPrivilege	1852	vssvc.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exeOrder:binOrder.execmd.execmd.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1508	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	Order:bin
PID 900 wrote to memory of 1508	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	Order:bin
PID 900 wrote to memory of 1508	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	Order:bin
PID 900 wrote to memory of 1508	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	Order:bin
PID 1508 wrote to memory of 1820	1508	Order:bin	vssadmin.exe
PID 1508 wrote to memory of 1820	1508	Order:bin	vssadmin.exe
PID 1508 wrote to memory of 1820	1508	Order:bin	vssadmin.exe
PID 1508 wrote to memory of 1820	1508	Order:bin	vssadmin.exe
PID 1508 wrote to memory of 1628	1508	Order:bin	takeown.exe
PID 1508 wrote to memory of 1628	1508	Order:bin	takeown.exe
PID 1508 wrote to memory of 1628	1508	Order:bin	takeown.exe
PID 1508 wrote to memory of 1628	1508	Order:bin	takeown.exe
PID 1508 wrote to memory of 1936	1508	Order:bin	icacls.exe
PID 1508 wrote to memory of 1936	1508	Order:bin	icacls.exe
PID 1508 wrote to memory of 1936	1508	Order:bin	icacls.exe
PID 1508 wrote to memory of 1936	1508	Order:bin	icacls.exe
PID 2000 wrote to memory of 1692	2000	Order.exe	cmd.exe
PID 2000 wrote to memory of 1692	2000	Order.exe	cmd.exe
PID 2000 wrote to memory of 1692	2000	Order.exe	cmd.exe
PID 2000 wrote to memory of 1692	2000	Order.exe	cmd.exe
PID 1508 wrote to memory of 624	1508	Order:bin	cmd.exe
PID 1508 wrote to memory of 624	1508	Order:bin	cmd.exe
PID 1508 wrote to memory of 624	1508	Order:bin	cmd.exe
PID 1508 wrote to memory of 624	1508	Order:bin	cmd.exe
PID 1692 wrote to memory of 1200	1692	cmd.exe	choice.exe
PID 1692 wrote to memory of 1200	1692	cmd.exe	choice.exe
PID 1692 wrote to memory of 1200	1692	cmd.exe	choice.exe
PID 1692 wrote to memory of 1200	1692	cmd.exe	choice.exe
PID 900 wrote to memory of 1348	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	cmd.exe
PID 900 wrote to memory of 1348	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	cmd.exe
PID 900 wrote to memory of 1348	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	cmd.exe
PID 900 wrote to memory of 1348	900	8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe	cmd.exe
PID 624 wrote to memory of 2044	624	cmd.exe	choice.exe
PID 624 wrote to memory of 2044	624	cmd.exe	choice.exe
PID 624 wrote to memory of 2044	624	cmd.exe	choice.exe
PID 624 wrote to memory of 2044	624	cmd.exe	choice.exe
PID 1348 wrote to memory of 1332	1348	cmd.exe	choice.exe
PID 1348 wrote to memory of 1332	1348	cmd.exe	choice.exe
PID 1348 wrote to memory of 1332	1348	cmd.exe	choice.exe
PID 1348 wrote to memory of 1332	1348	cmd.exe	choice.exe
PID 1692 wrote to memory of 1504	1692	cmd.exe	attrib.exe
PID 1692 wrote to memory of 1504	1692	cmd.exe	attrib.exe
PID 1692 wrote to memory of 1504	1692	cmd.exe	attrib.exe
PID 1692 wrote to memory of 1504	1692	cmd.exe	attrib.exe
PID 624 wrote to memory of 1576	624	cmd.exe	attrib.exe
PID 624 wrote to memory of 1576	624	cmd.exe	attrib.exe
PID 624 wrote to memory of 1576	624	cmd.exe	attrib.exe
PID 624 wrote to memory of 1576	624	cmd.exe	attrib.exe
PID 1348 wrote to memory of 1708	1348	cmd.exe	attrib.exe
PID 1348 wrote to memory of 1708	1348	cmd.exe	attrib.exe
PID 1348 wrote to memory of 1708	1348	cmd.exe	attrib.exe
PID 1348 wrote to memory of 1708	1348	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

1504 attrib.exe
1576 attrib.exe
1708 attrib.exe

pid	process
1504	attrib.exe
1576	attrib.exe
1708	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe
"C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe"
1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Roaming\Order:bin
C:\Users\Admin\AppData\Roaming\Order:bin -r
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1820

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /F C:\Windows\system32\Order.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1628

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\Windows\system32\Order.exe /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Order" & del "C:\Users\Admin\AppData\Roaming\Order"
3⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
4⤵
PID:2044

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Roaming\Order"
4⤵
- Views/modifies file attributes
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:1332

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.bin.exe"
3⤵
- Views/modifies file attributes
PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\SysWOW64\Order.exe
C:\Windows\SysWOW64\Order.exe -s
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Order.exe" & del "C:\Windows\SysWOW64\Order.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:1200

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Windows\SysWOW64\Order.exe"
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:1504

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

File Permissions Modification

1

T1222

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Order:bin
MD5
7e34c5bd27f25a1e1d47a27702708e28

SHA1
fb65ea1cc1d81a17effe16ecd2d10f34975a67d8

SHA256
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01

SHA512
2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f

Download Submit
C:\Users\Admin\AppData\Roaming\Order:bin
MD5
7e34c5bd27f25a1e1d47a27702708e28

SHA1
fb65ea1cc1d81a17effe16ecd2d10f34975a67d8

SHA256
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01

SHA512
2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f

Download Submit
C:\Windows\SysWOW64\Order.exe
MD5
7e34c5bd27f25a1e1d47a27702708e28

SHA1
fb65ea1cc1d81a17effe16ecd2d10f34975a67d8

SHA256
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01

SHA512
2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f

Download Submit
C:\Windows\SysWOW64\Order.exe
MD5
7e34c5bd27f25a1e1d47a27702708e28

SHA1
fb65ea1cc1d81a17effe16ecd2d10f34975a67d8

SHA256
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01

SHA512
2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f

Download Submit
\Users\Admin\AppData\Roaming\Order
MD5
4a6554c141450d2b6aa6de17a298aeda

SHA1
f1cb6ac51688e4e02daa048b0225e27aabb1f715

SHA256
8592466beed427a39e608b0ef01cc2c1dc4d2337cf913a8d47e4c2ec30f9bd6b

SHA512
3b46cb22f821323c36c3597a76686b25afc69b0e66002eeb6b5a9699eed581a1e908d3a402db3a08f44a8b680cf6e5c89b355af68af427a3ad6e7c9d95e9086a

Download Submit
\Users\Admin\AppData\Roaming\Order
MD5
4a6554c141450d2b6aa6de17a298aeda

SHA1
f1cb6ac51688e4e02daa048b0225e27aabb1f715

SHA256
8592466beed427a39e608b0ef01cc2c1dc4d2337cf913a8d47e4c2ec30f9bd6b

SHA512
3b46cb22f821323c36c3597a76686b25afc69b0e66002eeb6b5a9699eed581a1e908d3a402db3a08f44a8b680cf6e5c89b355af68af427a3ad6e7c9d95e9086a

Download Submit
memory/624-11-0x0000000000000000-mapping.dmp

Download
memory/1200-12-0x0000000000000000-mapping.dmp

Download
memory/1332-15-0x0000000000000000-mapping.dmp

Download
memory/1348-13-0x0000000000000000-mapping.dmp

Download
memory/1504-16-0x0000000000000000-mapping.dmp

Download
memory/1508-2-0x0000000000000000-mapping.dmp

Download
memory/1576-17-0x0000000000000000-mapping.dmp

Download
memory/1628-6-0x0000000000000000-mapping.dmp

Download
memory/1692-10-0x0000000000000000-mapping.dmp

Download
memory/1708-18-0x0000000000000000-mapping.dmp

Download
memory/1820-4-0x0000000000000000-mapping.dmp

Download
memory/1936-8-0x0000000000000000-mapping.dmp

Download
memory/2044-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads