0d9620cc6f13557348009640f972fef49c151e28e8a6513fb5fc0e8cce54fee9

General

Target

order.exe
Size

713KB
MD5

0b6d5d917fd841fc0ccb900d1d0817d2
SHA1

fe706ce3530b8be18f49a195c621dfc77b4f2fce
SHA256

01c7dd686988aded4a1730159eaaa2f4ecfb9f53dc93a3f9ba0503b7698aa454
SHA512

b83f7d278553e06903bbc798cfbea3d671b86756a04d2562db33da3e406f7124c1e3862a0286c9406ada254e8e173af428d8364296d309db55689121ac9a50a1

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

order.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	order.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	order.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1684 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeorder.exe

pid process

992 powershell.exe
1280 order.exe
1280 order.exe
1280 order.exe
1280 order.exe
1280 order.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeorder.exe

description pid process

Token: SeDebugPrivilege 992 powershell.exe
Token: SeDebugPrivilege 1280 order.exe

pid	process
1684	schtasks.exe

pid	process
992	powershell.exe
1280	order.exe
1280	order.exe
1280	order.exe
1280	order.exe
1280	order.exe

description	pid	process
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	1280	order.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

order.exe

description	pid	process	target process
PID 1280 wrote to memory of 992	1280	order.exe	powershell.exe
PID 1280 wrote to memory of 992	1280	order.exe	powershell.exe
PID 1280 wrote to memory of 992	1280	order.exe	powershell.exe
PID 1280 wrote to memory of 992	1280	order.exe	powershell.exe
PID 1280 wrote to memory of 1684	1280	order.exe	schtasks.exe
PID 1280 wrote to memory of 1684	1280	order.exe	schtasks.exe
PID 1280 wrote to memory of 1684	1280	order.exe	schtasks.exe
PID 1280 wrote to memory of 1684	1280	order.exe	schtasks.exe
PID 1280 wrote to memory of 276	1280	order.exe	order.exe
PID 1280 wrote to memory of 276	1280	order.exe	order.exe
PID 1280 wrote to memory of 276	1280	order.exe	order.exe
PID 1280 wrote to memory of 276	1280	order.exe	order.exe
PID 1280 wrote to memory of 1268	1280	order.exe	order.exe
PID 1280 wrote to memory of 1268	1280	order.exe	order.exe
PID 1280 wrote to memory of 1268	1280	order.exe	order.exe
PID 1280 wrote to memory of 1268	1280	order.exe	order.exe
PID 1280 wrote to memory of 1768	1280	order.exe	order.exe
PID 1280 wrote to memory of 1768	1280	order.exe	order.exe
PID 1280 wrote to memory of 1768	1280	order.exe	order.exe
PID 1280 wrote to memory of 1768	1280	order.exe	order.exe
PID 1280 wrote to memory of 676	1280	order.exe	order.exe
PID 1280 wrote to memory of 676	1280	order.exe	order.exe
PID 1280 wrote to memory of 676	1280	order.exe	order.exe
PID 1280 wrote to memory of 676	1280	order.exe	order.exe
PID 1280 wrote to memory of 580	1280	order.exe	order.exe
PID 1280 wrote to memory of 580	1280	order.exe	order.exe
PID 1280 wrote to memory of 580	1280	order.exe	order.exe
PID 1280 wrote to memory of 580	1280	order.exe	order.exe

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HtyuqY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A2.tmp"
2⤵
- Creates scheduled task(s)
PID:1684

C:\Users\Admin\AppData\Local\Temp\order.exe
"{path}"
2⤵
PID:276

C:\Users\Admin\AppData\Local\Temp\order.exe
"{path}"
2⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\order.exe
"{path}"
2⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\order.exe
"{path}"
2⤵
PID:676

C:\Users\Admin\AppData\Local\Temp\order.exe
"{path}"
2⤵
PID:580

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9A2.tmp
Filesize
1KB

MD5
44870692c9204df5f85f04f04326cb63

SHA1
33597a78229d338db2c1dffdbd432ede59d080ea

SHA256
638c593a94b27169724d82508cc5c3fc35c9f67b955ba850efa3a4573e6662fc

SHA512
9a39fde1a6872124f6d69a1ea559dd1d6dbef32a2407943df21fba68398e54855c24098ecd6c2fe6ff0cea78e66acba5268f532221e3d299a453818e4e136bdc

Download Submit
memory/992-56-0x0000000000000000-mapping.dmp

Download
memory/992-58-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1280-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1280-55-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1684-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads