07a092c1770ce812ae35ae8f1b5a6d1e4ff4bdc8bdc9fc47ee04a863ada28c4c

General

Target

New_Order.exe
Size

1.4MB
MD5

13acc68e0a13b3ad443c4fb9c223cdd5
SHA1

6c0eba3ef285cf18c845823b71327b774ca1cba9
SHA256

20ec6cdb323f2e2eea0bfb107e820a079a41a3fc6afdf8378de930d7aa7b4160
SHA512

e5333ad504d0729820d72ae0679bb9383e0395680d18d1459506ccdec3f2333e5642df502320e0b372953f702d41f5142eddee7f9c6bcedf8608dd15adc23490

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

New_Order.exe

description pid process target process

PID 3460 set thread context of 4664 3460 New_Order.exe New_Order.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

New_Order.exepowershell.exe

pid process

4664 New_Order.exe
4664 New_Order.exe
4284 powershell.exe
4284 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New_Order.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4664 New_Order.exe
Token: SeDebugPrivilege 4284 powershell.exe

description	pid	process	target process
PID 3460 set thread context of 4664	3460	New_Order.exe	New_Order.exe

pid	process
4664	New_Order.exe
4664	New_Order.exe
4284	powershell.exe
4284	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4664	New_Order.exe
Token: SeDebugPrivilege	4284	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

New_Order.exeNew_Order.execmd.exe

description	pid	process	target process
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 3460 wrote to memory of 4664	3460	New_Order.exe	New_Order.exe
PID 4664 wrote to memory of 3740	4664	New_Order.exe	cmd.exe
PID 4664 wrote to memory of 3740	4664	New_Order.exe	cmd.exe
PID 4664 wrote to memory of 3740	4664	New_Order.exe	cmd.exe
PID 3740 wrote to memory of 4284	3740	cmd.exe	powershell.exe
PID 3740 wrote to memory of 4284	3740	cmd.exe	powershell.exe
PID 3740 wrote to memory of 4284	3740	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\New_Order.exe
"C:\Users\Admin\AppData\Local\Temp\New_Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\New_Order.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Order.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Order.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Order.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New_Order.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
memory/3460-131-0x00000000051C0000-0x000000000525C000-memory.dmp

Filesize
624KB

Download
memory/3460-132-0x00000000058C0000-0x0000000005E64000-memory.dmp

Filesize
5.6MB

Download
memory/3460-133-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/3460-134-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/3460-135-0x0000000005510000-0x0000000005566000-memory.dmp

Filesize
344KB

Download
memory/3460-130-0x00000000006E0000-0x0000000000846000-memory.dmp

Filesize
1.4MB

Download
memory/3740-140-0x0000000000000000-mapping.dmp

Download
memory/4284-144-0x00000000052B0000-0x00000000052D2000-memory.dmp

Filesize
136KB

Download
memory/4284-141-0x0000000000000000-mapping.dmp

Download
memory/4284-142-0x0000000002740000-0x0000000002776000-memory.dmp

Filesize
216KB

Download
memory/4284-143-0x0000000005360000-0x0000000005988000-memory.dmp

Filesize
6.2MB

Download
memory/4284-145-0x0000000005990000-0x00000000059F6000-memory.dmp

Filesize
408KB

Download
memory/4284-146-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/4284-147-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/4284-148-0x0000000006580000-0x000000000659A000-memory.dmp

Filesize
104KB

Download
memory/4284-149-0x0000000007300000-0x0000000007396000-memory.dmp

Filesize
600KB

Download
memory/4284-150-0x0000000006640000-0x0000000006662000-memory.dmp

Filesize
136KB

Download
memory/4664-139-0x0000000005160000-0x00000000051C6000-memory.dmp

Filesize
408KB

Download
memory/4664-136-0x0000000000000000-mapping.dmp

Download
memory/4664-137-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads