f332ebde8b3dc026728bf80e7edd9b0c0809e8df2e28f6baabaaa3327a295dca

Analysis

max time kernel
144s
max time network
137s
platform
windows7_x64
resource
win7
submitted
22/10/2020, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order-PI.exe
Size 500KB
Sample201022-tye24trfre
SHA256 f332ebde8b3dc026728bf80e7edd9b0c0809e8df2e28f6baabaaa3327a295dca
MD5 ef6260889c044dc08a788a983efa52a3
SHA1 ea8c11aff84790e64eb93981306bafa4400a846f
SHA512 9c8a32ea373ea0b5ce8177b4a76c72188de3bf52befd0d1eacef3fe59ecc632a7d2f3c5ef6deef99e6d5cb8a5e78fb8452518a6d82d490d41c4aecd1f7f090a7
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1608	winlogs.exe
872	InstallUtil.exe

Loads dropped DLL 5 IoCs

pid	Process
1768	New Order-PI.exe
1768	New Order-PI.exe
1608	winlogs.exe
1608	winlogs.exe
1608	winlogs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 872	1608	winlogs.exe	35

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1768	New Order-PI.exe
1768	New Order-PI.exe
1608	winlogs.exe
872	InstallUtil.exe
872	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	New Order-PI.exe
Token: SeTakeOwnershipPrivilege	1768	New Order-PI.exe
Token: SeRestorePrivilege	1768	New Order-PI.exe
Token: SeDebugPrivilege	1608	winlogs.exe
Token: SeTakeOwnershipPrivilege	1608	winlogs.exe
Token: SeRestorePrivilege	1608	winlogs.exe
Token: SeDebugPrivilege	872	InstallUtil.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1672	1768	New Order-PI.exe	28
PID 1768 wrote to memory of 1672	1768	New Order-PI.exe	28
PID 1768 wrote to memory of 1672	1768	New Order-PI.exe	28
PID 1768 wrote to memory of 1672	1768	New Order-PI.exe	28
PID 1672 wrote to memory of 1408	1672	cmd.exe	30
PID 1672 wrote to memory of 1408	1672	cmd.exe	30
PID 1672 wrote to memory of 1408	1672	cmd.exe	30
PID 1672 wrote to memory of 1408	1672	cmd.exe	30
PID 1768 wrote to memory of 1608	1768	New Order-PI.exe	31
PID 1768 wrote to memory of 1608	1768	New Order-PI.exe	31
PID 1768 wrote to memory of 1608	1768	New Order-PI.exe	31
PID 1768 wrote to memory of 1608	1768	New Order-PI.exe	31
PID 1608 wrote to memory of 1320	1608	winlogs.exe	32
PID 1608 wrote to memory of 1320	1608	winlogs.exe	32
PID 1608 wrote to memory of 1320	1608	winlogs.exe	32
PID 1608 wrote to memory of 1320	1608	winlogs.exe	32
PID 1320 wrote to memory of 1000	1320	cmd.exe	34
PID 1320 wrote to memory of 1000	1320	cmd.exe	34
PID 1320 wrote to memory of 1000	1320	cmd.exe	34
PID 1320 wrote to memory of 1000	1320	cmd.exe	34
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35
PID 1608 wrote to memory of 872	1608	winlogs.exe	35

C:\Users\Admin\AppData\Local\Temp\New Order-PI.exe
"C:\Users\Admin\AppData\Local\Temp\New Order-PI.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
    3⤵
    PID:1408
- C:\Users\Admin\AppData\Roaming\winlogs.exe
  "C:\Users\Admin\AppData\Roaming\winlogs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
      4⤵
      PID:1000
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-28-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/872-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/872-26-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/872-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1608-19-0x00000000049C0000-0x00000000049D6000-memory.dmp

Download

memory/1608-12-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1608-11-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/1768-3-0x00000000002E0000-0x0000000000312000-memory.dmp

Download

memory/1768-0-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/1768-1-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download