Overview

overview

7

Static

static

1

New Order.exe

windows7-x64

7

New Order.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    189s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2023, 23:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Order.exe
  • Size 278KB
  • Sample230211-299b7seb48
  • SHA256 8aa4a5feee91f2caa993c9624153ee2ecbe97098fc7470a5103c408376b2a12a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\New Order.exe
      "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\ilbili.exe
        "C:\Users\Admin\AppData\Local\Temp\ilbili.exe" C:\Users\Admin\AppData\Local\Temp\ihbztw.wc
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Users\Admin\AppData\Local\Temp\ilbili.exe
          "C:\Users\Admin\AppData\Local\Temp\ilbili.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2308
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:772
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3940
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3940 -s 188
            4⤵
            • Program crash
            PID:5076
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 452 -p 3940 -ip 3940
      1⤵
        PID:4336

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            gzapwnn.ygr
            • Path C:\Users\Admin\AppData\Local\Temp\gzapwnn.ygr
            • Size 206KB
            • SHA256 7fe75b9ed0ee3650a8a5ef0546aaebd426c1044d163a8fda85a2a54601dbc7b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ihbztw.wc
            • Path C:\Users\Admin\AppData\Local\Temp\ihbztw.wc
            • Size 6KB
            • SHA256 7551c0ff3cb9902020c6abb22179780ee833d991d33f358f4d17bedbc82e4f32
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ilbili.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ilbili.exe
            • Size 63KB
            • SHA256 db55ec5ea251f0e151044aa3e4a6ecef650fe33bee9645bb0de736ff722f6d16
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ilbili.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ilbili.exe
            • Size 63KB
            • SHA256 db55ec5ea251f0e151044aa3e4a6ecef650fe33bee9645bb0de736ff722f6d16
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ilbili.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ilbili.exe
            • Size 63KB
            • SHA256 db55ec5ea251f0e151044aa3e4a6ecef650fe33bee9645bb0de736ff722f6d16
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/372-142-0x0000000008E40000-0x0000000008F09000-memory.dmp
            Download

            memory/372-151-0x0000000008F20000-0x0000000009004000-memory.dmp
            Download

            memory/372-149-0x0000000008F20000-0x0000000009004000-memory.dmp
            Download

            memory/772-147-0x0000000002DB0000-0x00000000030FA000-memory.dmp
            Download

            memory/772-145-0x0000000000F60000-0x0000000000F6C000-memory.dmp
            Download

            memory/772-146-0x0000000000BA0000-0x0000000000BCD000-memory.dmp
            Download

            memory/772-148-0x0000000002AE0000-0x0000000002B6F000-memory.dmp
            Download

            memory/772-150-0x0000000000BA0000-0x0000000000BCD000-memory.dmp
            Download

            memory/2308-141-0x00000000005A0000-0x00000000005B0000-memory.dmp
            Download

            memory/2308-140-0x0000000000A40000-0x0000000000D8A000-memory.dmp
            Download

            memory/2308-144-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/2308-139-0x0000000000400000-0x000000000042F000-memory.dmp
            Download