f5e1d6a3d030e6ea4f3393a470ace4e814e972b5bfbdcf7837e356431a51166e

Analysis

max time kernel
151s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/09/2022, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order specification.exe
Size 698KB
Sample220905-nt1s8sgcan
SHA256 f5e1d6a3d030e6ea4f3393a470ace4e814e972b5bfbdcf7837e356431a51166e
MD5 4ceeb134e2c08eb28b016c9106a48d70
SHA1 5a72c6446ce0fff5319f76585e0bcf2d56d2bf62
SHA512 6eec8bf33ccf92171820f052282cd4064161a21b65790fc9c8ed49beec0243612322ec03d985c1c6b9850e07593725182c3d46dd5d280873b8d613d515add52a
SSDEEP 12288:WzE+xz2iNEF75euLUk/hPxg1uIuK6mgfYed08wkNi7tF1WrLdkUT:cz16Z5ffPJcu08XNi7rsKQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	Order specification.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1188	1720	Order specification.exe	27
PID 1188 set thread context of 1260	1188	Order specification.exe	15

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1188	Order specification.exe
1188	Order specification.exe
1188	Order specification.exe
1188	Order specification.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1188	Order specification.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	Order specification.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27
PID 1720 wrote to memory of 1188	1720	Order specification.exe	27

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\Order specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Order specification.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Order specification.exe
    "C:\Users\Admin\AppData\Local\Temp\Order specification.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-60-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1188-61-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1188-63-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1188-66-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1188-67-0x0000000000401000-0x000000000042D000-memory.dmp

Download

memory/1720-54-0x0000000000340000-0x00000000003F4000-memory.dmp

Download

memory/1720-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download

memory/1720-56-0x0000000000600000-0x0000000000618000-memory.dmp

Download

memory/1720-57-0x0000000000620000-0x000000000062C000-memory.dmp

Download

memory/1720-58-0x0000000004FF0000-0x000000000507E000-memory.dmp

Download

memory/1720-59-0x00000000040D0000-0x0000000004104000-memory.dmp

Download