ac8a052005110b9a07f80af54d274429789ff8386fa2198925e3262d85fe448c

Analysis

max time kernel
43s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEWorder2022FILE8876.exe
Size

829KB
MD5

443188c8e6b449066d99f49d1b715e92
SHA1

7ebde06ed2558ad169e7b779ac2f7bc8bc758ef0
SHA256

15046684df239f63119e30eadc6a71abbfece9080bb3a6a1d4f7b0899ee47409
SHA512

1c063339b87ebe67daf14c58f20cbe917885d12ff3d1161e8e7180752710819c5b1aea92b104130d3a42beaa5906691938656c0f394591d2e2ba3beb5de31fee
SSDEEP

12288:D3YNF3wX+sJMgCEdhJlxnFrQ9dI640gfHtY/h8uSW7rbLxPkgUUj5TX:j8GlJMkdhVnaHI6ufNkUEpaE

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

NEWorder2022FILE8876.exe

pid	process
1628	NEWorder2022FILE8876.exe
1628	NEWorder2022FILE8876.exe
1628	NEWorder2022FILE8876.exe
1628	NEWorder2022FILE8876.exe
1628	NEWorder2022FILE8876.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEWorder2022FILE8876.exe

description pid process

Token: SeDebugPrivilege 1628 NEWorder2022FILE8876.exe

description	pid	process
Token: SeDebugPrivilege	1628	NEWorder2022FILE8876.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

NEWorder2022FILE8876.exe

description	pid	process	target process
PID 1628 wrote to memory of 1020	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1020	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1020	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1020	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1504	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1504	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1504	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 1504	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 796	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 796	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 796	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 796	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 376	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 376	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 376	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 376	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 516	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 516	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 516	1628	NEWorder2022FILE8876.exe	vbc.exe
PID 1628 wrote to memory of 516	1628	NEWorder2022FILE8876.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\NEWorder2022FILE8876.exe
"C:\Users\Admin\AppData\Local\Temp\NEWorder2022FILE8876.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:516

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x0000000000160000-0x0000000000236000-memory.dmp

Filesize
856KB

Download
memory/1628-55-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download