Order.exe

General
Target

Order.exe

Filesize

853KB

Completed

21-07-2021 06:07

Score
3 /10
MD5

103362e59d9fd456e9ce47da23e14e4f

SHA1

5f557d79f1085f1e05da881204d341f2c82b20b9

SHA256

f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40

Malware Config
Signatures 5

Filter: none

Discovery
Persistence
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1528schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    Order.exe

    Reported IOCs

    pidprocess
    332Order.exe
    332Order.exe
    332Order.exe
    332Order.exe
    332Order.exe
  • Suspicious use of AdjustPrivilegeToken
    Order.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege332Order.exe
  • Suspicious use of WriteProcessMemory
    Order.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 332 wrote to memory of 1528332Order.exeschtasks.exe
    PID 332 wrote to memory of 1528332Order.exeschtasks.exe
    PID 332 wrote to memory of 1528332Order.exeschtasks.exe
    PID 332 wrote to memory of 1528332Order.exeschtasks.exe
    PID 332 wrote to memory of 1852332Order.exeOrder.exe
    PID 332 wrote to memory of 1852332Order.exeOrder.exe
    PID 332 wrote to memory of 1852332Order.exeOrder.exe
    PID 332 wrote to memory of 1852332Order.exeOrder.exe
    PID 332 wrote to memory of 1600332Order.exeOrder.exe
    PID 332 wrote to memory of 1600332Order.exeOrder.exe
    PID 332 wrote to memory of 1600332Order.exeOrder.exe
    PID 332 wrote to memory of 1600332Order.exeOrder.exe
    PID 332 wrote to memory of 1388332Order.exeOrder.exe
    PID 332 wrote to memory of 1388332Order.exeOrder.exe
    PID 332 wrote to memory of 1388332Order.exeOrder.exe
    PID 332 wrote to memory of 1388332Order.exeOrder.exe
    PID 332 wrote to memory of 1700332Order.exeOrder.exe
    PID 332 wrote to memory of 1700332Order.exeOrder.exe
    PID 332 wrote to memory of 1700332Order.exeOrder.exe
    PID 332 wrote to memory of 1700332Order.exeOrder.exe
    PID 332 wrote to memory of 520332Order.exeOrder.exe
    PID 332 wrote to memory of 520332Order.exeOrder.exe
    PID 332 wrote to memory of 520332Order.exeOrder.exe
    PID 332 wrote to memory of 520332Order.exeOrder.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Order.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:332
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp"
      Creates scheduled task(s)
      PID:1528
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      PID:1852
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      PID:1600
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      PID:1388
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      PID:1700
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      PID:520
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp

                        MD5

                        7ea6959c0d608f16409c383bda65bf6f

                        SHA1

                        5643c8fa7c7b2d073d68471d1df129ff88baa864

                        SHA256

                        756aac73b621b8c1fd4a4a8cd7cbeb4d2af677fa81a4230935e1fd4b8d98c6e7

                        SHA512

                        8737eae3ad0c8e4c3016845627b65e0d0305cce393781b7e26f72b81aab096b568e3278fd36318170f7d840dc6c5dbbb7abaf729702c77cfa6c3547fe1b52054

                      • memory/332-61-0x0000000004E30000-0x0000000004E31000-memory.dmp

                      • memory/332-62-0x0000000000560000-0x0000000000562000-memory.dmp

                      • memory/332-63-0x0000000004E70000-0x0000000004F27000-memory.dmp

                      • memory/332-64-0x0000000002240000-0x00000000022AB000-memory.dmp

                      • memory/332-59-0x0000000000380000-0x0000000000381000-memory.dmp

                      • memory/1528-65-0x0000000000000000-mapping.dmp