Analysis
- max time kernel
151s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
21/02/2022, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target New Order.exe
- Size 639KB
- Sample220221-2mlydsbce6
- SHA256 7986c14ae93e53bf4616d1c6ccdcc6e882974fb190892d9e597d22d36622d9d8
- MD5 cfbd31988f29e73136639cb2348eb634
- SHA1 6597d7de6b4377d15482f8ac236363c7775439d4
- SHA512 4665ad7c6223429e7cdb6e4c4b3f18a23f8fade93de5b8dceddf75bb327ea84e8708f5f37b4362cd05c6e1f9dd85242d307c9c9c83cc7dbfb28dcdef8d3fa3a2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
matiex
Credentials
-
Protocol
smtp
-
Host
mail.cleo2solutions.com.au
-
Port
25
-
Username
-
Password
Enter@123
Signatures
- Matiex Main Payload 1 IoCs
resource yara_rule behavioral2/memory/3428-138-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4092 created 3428 4092 WerFault.exe 88 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation New Order.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 69 freegeoip.app 66 checkip.dyndns.org 68 freegeoip.app - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 208 set thread context of 3428 208 New Order.exe 88 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 3044 3428 WerFault.exe 88 552 3428 WerFault.exe 88 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2184 schtasks.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4316" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901333600963463" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.716309" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.787841" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4084" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.999462" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 208 New Order.exe 208 New Order.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe Token: SeRestorePrivilege 3388 TiWorker.exe Token: SeSecurityPrivilege 3388 TiWorker.exe Token: SeBackupPrivilege 3388 TiWorker.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 208 wrote to memory of 2184 208 New Order.exe 85 PID 208 wrote to memory of 2184 208 New Order.exe 85 PID 208 wrote to memory of 2184 208 New Order.exe 85 PID 208 wrote to memory of 2172 208 New Order.exe 87 PID 208 wrote to memory of 2172 208 New Order.exe 87 PID 208 wrote to memory of 2172 208 New Order.exe 87 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 208 wrote to memory of 3428 208 New Order.exe 88 PID 3428 wrote to memory of 3044 3428 MSBuild.exe 92 PID 3428 wrote to memory of 3044 3428 MSBuild.exe 92 PID 3428 wrote to memory of 3044 3428 MSBuild.exe 92 PID 4092 wrote to memory of 3428 4092 WerFault.exe 88 PID 4092 wrote to memory of 3428 4092 WerFault.exe 88 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GXanFoGUPxcgK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp654A.tmp"2⤵
- Creates scheduled task(s)
PID:2184
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵PID:2172
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 20803⤵
- Program crash
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 20803⤵
- Program crash
PID:552
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1340
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1180
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3428 -ip 34281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4092