Analysis
- max time kernel
167s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/02/2022, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
ORDER_96.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target ORDER_96.exe
- Size 292KB
- Sample220217-jbvr2sbgbp
- SHA256 e9fe0fe5cd5d59f973f1ea299c3476fbbd9e6a95f44509854286f584a313837c
- MD5 d279a9125327264ffc89fb5cb4d8e433
- SHA1 44ec118059baa04d7f812ed30f52b15aa138b181
- SHA512 eb7d2a41cb461af28f961f4ae903d56bf730f3307e2bab1e91ac7e4b1b7ab6289f00ee2463f8d2477b9ffaba6e2667ff424628cf2dbc92a88716da98cd9c2db2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
uar3
Decoy
-
sgadvocats.com
-
mjscannabus.com
-
hilldaley.com
-
ksdollhouse.com
-
hotgiftboutique.com
-
purebloodsmeet.com
-
relaunched.info
-
cap-glove.com
-
productcollection.store
-
fulikyy.xyz
-
remoteaviationjobs.com
-
bestcleancrystal.com
-
virtualorganizationpartner.com
-
bookgocar.com
-
hattuafhv.quest
-
makonigroup.com
-
officecom-myaccount.com
-
malgorzata-lac.com
-
e-learningeducators.com
-
hygilaur.com
-
kgv-lachswehr.com
-
salazarcomunicacion.com
-
robopython.com
-
corporateequity.online
-
complianceservicegroup.com
-
aperza-ex.com
-
webflowusa.com
-
asesoriasfinancieras.xyz
-
missolivesbranches.com
-
numiquest.com
-
criskconsultancy.com
-
gotemup.com
-
themaptalk.com
-
lakebalboahalf.com
-
cateringfrenchcroissant.com
-
paddocklakerealestate.com
-
lojaquerosurprezza.store
-
courtneywhitearmusic.com
-
geovannimaquinadevendas.online
-
pricklypairjazz.com
-
engagedigi.com
-
conduitforthespirit.com
-
anaheimaletrail.com
-
wholesalemall.store
-
alertsbecu.com
-
gestion-kayfra.com
-
youcanstores.com
-
qsuo.net
-
formadv.info
-
dihesia.xyz
-
carrreir.com
-
twenteeminuteswithtee.com
-
realliferenewal.com
-
officialprokodsukses.icu
-
stanfordgrouploscabos.com
-
maxicashpromir.xyz
-
zysqshjs.com
-
trc-clicks.com
-
chsclbd.com
-
amdproduce.net
-
republicoflies.com
-
beaux-parents.com
-
lucrativeapp.com
-
milbombas.com
-
alexanderplaywear.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3056-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2480-143-0x0000000002F70000-0x0000000002F99000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 3472 xzwgzw.exe 3056 xzwgzw.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3472 set thread context of 3056 3472 xzwgzw.exe 63 PID 3056 set thread context of 2412 3056 xzwgzw.exe 32 PID 2480 set thread context of 2412 2480 systray.exe 32 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.347959" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4084" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132897331761912752" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4192" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.186289" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3056 xzwgzw.exe 3056 xzwgzw.exe 3056 xzwgzw.exe 3056 xzwgzw.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe 2480 systray.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3056 xzwgzw.exe 3056 xzwgzw.exe 3056 xzwgzw.exe 2480 systray.exe 2480 systray.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3056 xzwgzw.exe Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE Token: SeDebugPrivilege 2480 systray.exe Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe Token: SeRestorePrivilege 1336 TiWorker.exe Token: SeSecurityPrivilege 1336 TiWorker.exe Token: SeBackupPrivilege 1336 TiWorker.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2412 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2800 wrote to memory of 3472 2800 ORDER_96.exe 61 PID 2800 wrote to memory of 3472 2800 ORDER_96.exe 61 PID 2800 wrote to memory of 3472 2800 ORDER_96.exe 61 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 3472 wrote to memory of 3056 3472 xzwgzw.exe 63 PID 2412 wrote to memory of 2480 2412 Explorer.EXE 64 PID 2412 wrote to memory of 2480 2412 Explorer.EXE 64 PID 2412 wrote to memory of 2480 2412 Explorer.EXE 64 PID 2480 wrote to memory of 1360 2480 systray.exe 65 PID 2480 wrote to memory of 1360 2480 systray.exe 65 PID 2480 wrote to memory of 1360 2480 systray.exe 65
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\ORDER_96.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_96.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\xzwgzw.exeC:\Users\Admin\AppData\Local\Temp\xzwgzw.exe C:\Users\Admin\AppData\Local\Temp\mxshkert3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\xzwgzw.exeC:\Users\Admin\AppData\Local\Temp\xzwgzw.exe C:\Users\Admin\AppData\Local\Temp\mxshkert4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xzwgzw.exe"3⤵PID:1360
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1852
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1336