Analysis
-
max time kernel
115s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
ORDER.exe
Resource
win7-20220901-en
General
-
Target
ORDER.exe
-
Size
862KB
-
MD5
d4bedaa24b4f2d4001325502a1bcf3bb
-
SHA1
e326c7f7045cc49aa94ddcda0f92fd794f6a182b
-
SHA256
5affdcb7df43eaffa763090a9c0c8159e6ec2f97181214c99bb28e3922f0f4cb
-
SHA512
e916454713007cb920699f3304d42c33d99b0c4c2c8a30472b22a644eb736a329e2d0ad970ae9e90a744004fab365c811da269b5bf091a11b0c8d6af2dc9ae18
-
SSDEEP
12288:xe2iNeAejHgWakKK4boAO135KLnYqr096OE0ls72h8DL2St2qjJ5nXe4x:xe1Gjak9qg5+nYM09s0lkvFHjrXe
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ORDER.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe" ORDER.exe -
Processes:
ORDER.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ORDER.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER.exedescription pid process target process PID 1340 set thread context of 1144 1340 ORDER.exe ORDER.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ORDER.exedescription ioc process File created C:\Program Files (x86)\AGP Manager\agpmgr.exe ORDER.exe File opened for modification C:\Program Files (x86)\AGP Manager\agpmgr.exe ORDER.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1520 schtasks.exe 1580 schtasks.exe 540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ORDER.exepid process 1144 ORDER.exe 1144 ORDER.exe 1144 ORDER.exe 1144 ORDER.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ORDER.exepid process 1144 ORDER.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ORDER.exedescription pid process Token: SeDebugPrivilege 1144 ORDER.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ORDER.exeORDER.exedescription pid process target process PID 1340 wrote to memory of 1520 1340 ORDER.exe schtasks.exe PID 1340 wrote to memory of 1520 1340 ORDER.exe schtasks.exe PID 1340 wrote to memory of 1520 1340 ORDER.exe schtasks.exe PID 1340 wrote to memory of 1520 1340 ORDER.exe schtasks.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1340 wrote to memory of 1144 1340 ORDER.exe ORDER.exe PID 1144 wrote to memory of 1580 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 1580 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 1580 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 1580 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 540 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 540 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 540 1144 ORDER.exe schtasks.exe PID 1144 wrote to memory of 540 1144 ORDER.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZTESxFWol" /XML "C:\Users\Admin\AppData\Local\Temp\tmp387F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3CB3.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3D7F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp387F.tmpFilesize
1KB
MD598283b4b598efdffac6135df1ab96d19
SHA165d88312e4a6ef252b027017692ceeeb193de45e
SHA256c870fbe775f9574fc4d0aded8e87cac1d45170378ae485b4519fa838bd8b36a2
SHA5123f3269ac2f532b66359586e5f2a4e17eaac8b33cee1ecbedb21ce96d55362ff059c4a5d475ef5bfc6c13867e529109e33e254b9994b07057fcaeae9f404cc36d
-
C:\Users\Admin\AppData\Local\Temp\tmp3CB3.tmpFilesize
1KB
MD543afabe24a830af0444dc1771f5dc45f
SHA148e33244666c4af62976f78be645861c54cbaf2e
SHA2560a330374229af71528e246356cfdc21bad94f4a7b4a2fb9b967ccb047fc89fd3
SHA512aad08996947de90113af8b0893134dd14c7d4b7369db7119eacc927feac79c3fea865a21b1263e95579cdcd5827fed5b50329b2768a7fa7e885ce99db59986a9
-
C:\Users\Admin\AppData\Local\Temp\tmp3D7F.tmpFilesize
1KB
MD5885d6dd30570594e167fadb59d9ca0ea
SHA19981e583644c4eb9cf5056615a0e1c2913c8983b
SHA2567155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2
SHA5121623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a
-
memory/540-76-0x0000000000000000-mapping.dmp
-
memory/1144-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-78-0x0000000000470000-0x000000000047A000-memory.dmpFilesize
40KB
-
memory/1144-92-0x0000000000F80000-0x0000000000F94000-memory.dmpFilesize
80KB
-
memory/1144-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-91-0x0000000004E40000-0x0000000004E6E000-memory.dmpFilesize
184KB
-
memory/1144-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-68-0x000000000041E792-mapping.dmp
-
memory/1144-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-90-0x0000000000F60000-0x0000000000F6E000-memory.dmpFilesize
56KB
-
memory/1144-89-0x0000000000F50000-0x0000000000F64000-memory.dmpFilesize
80KB
-
memory/1144-88-0x0000000000F40000-0x0000000000F50000-memory.dmpFilesize
64KB
-
memory/1144-87-0x0000000000F30000-0x0000000000F44000-memory.dmpFilesize
80KB
-
memory/1144-86-0x0000000000EE0000-0x0000000000EEC000-memory.dmpFilesize
48KB
-
memory/1144-79-0x0000000000500000-0x000000000051E000-memory.dmpFilesize
120KB
-
memory/1144-80-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/1144-81-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/1144-82-0x0000000000C30000-0x0000000000C4A000-memory.dmpFilesize
104KB
-
memory/1144-83-0x0000000000A10000-0x0000000000A1E000-memory.dmpFilesize
56KB
-
memory/1144-84-0x0000000000D80000-0x0000000000D92000-memory.dmpFilesize
72KB
-
memory/1144-85-0x0000000000D90000-0x0000000000D9E000-memory.dmpFilesize
56KB
-
memory/1340-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1340-56-0x0000000000380000-0x00000000003A0000-memory.dmpFilesize
128KB
-
memory/1340-57-0x00000000059B0000-0x0000000005A3C000-memory.dmpFilesize
560KB
-
memory/1340-54-0x00000000010F0000-0x00000000011CE000-memory.dmpFilesize
888KB
-
memory/1340-58-0x0000000000B70000-0x0000000000BAA000-memory.dmpFilesize
232KB
-
memory/1520-59-0x0000000000000000-mapping.dmp
-
memory/1580-74-0x0000000000000000-mapping.dmp