Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2023, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
rORDERINQUIRY_pdf.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
rORDERINQUIRY_pdf.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target rORDERINQUIRY_pdf.exe
- Size 249KB
- Sample230308-pygrlaaa79
- SHA256 81b7ee55b75f60bbf42484de670154d6a7c182bdfe1181e3a89bb4483dfd6944
- MD5 6682d9d38bbff318f65c39100534f32f
- SHA1 6839ee1960631c24f06b927c8f6fb3cbc6a2aa04
- SHA512 437de33ea67954144f855c6b03ca3a2bfd5b7c194d7bb4219518ba1a730fdb8ebd9cba24a86df082ce6f3c98a88cd9904f79c7340f119eaedd20a8074ddbb85f
- SSDEEP 6144:/Ya6E8tKKmuHztTgpoMoz6cGpyRlNsjz2peSrheXzaW:/YK8jBJiMpGpyNpeSNeeW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation hideggu.exe - Executes dropped EXE 2 IoCs
pid Process 1252 hideggu.exe 4396 hideggu.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1252 set thread context of 4396 1252 hideggu.exe 87 PID 4396 set thread context of 3192 4396 hideggu.exe 35 PID 3224 set thread context of 3192 3224 explorer.exe 35 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \Registry\User\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3192 Explorer.EXE - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1252 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 4396 hideggu.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe 3224 explorer.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4396 hideggu.exe Token: SeDebugPrivilege 3224 explorer.exe Token: SeShutdownPrivilege 3192 Explorer.EXE Token: SeCreatePagefilePrivilege 3192 Explorer.EXE Token: SeShutdownPrivilege 3192 Explorer.EXE Token: SeCreatePagefilePrivilege 3192 Explorer.EXE Token: SeShutdownPrivilege 3192 Explorer.EXE Token: SeCreatePagefilePrivilege 3192 Explorer.EXE Token: SeShutdownPrivilege 3192 Explorer.EXE Token: SeCreatePagefilePrivilege 3192 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3192 Explorer.EXE 3192 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1252 5064 rORDERINQUIRY_pdf.exe 86 PID 5064 wrote to memory of 1252 5064 rORDERINQUIRY_pdf.exe 86 PID 5064 wrote to memory of 1252 5064 rORDERINQUIRY_pdf.exe 86 PID 1252 wrote to memory of 4396 1252 hideggu.exe 87 PID 1252 wrote to memory of 4396 1252 hideggu.exe 87 PID 1252 wrote to memory of 4396 1252 hideggu.exe 87 PID 1252 wrote to memory of 4396 1252 hideggu.exe 87 PID 3192 wrote to memory of 3224 3192 Explorer.EXE 88 PID 3192 wrote to memory of 3224 3192 Explorer.EXE 88 PID 3192 wrote to memory of 3224 3192 Explorer.EXE 88 PID 3224 wrote to memory of 4372 3224 explorer.exe 95 PID 3224 wrote to memory of 4372 3224 explorer.exe 95 PID 3224 wrote to memory of 4372 3224 explorer.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\rORDERINQUIRY_pdf.exe"C:\Users\Admin\AppData\Local\Temp\rORDERINQUIRY_pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\hideggu.exe"C:\Users\Admin\AppData\Local\Temp\hideggu.exe" C:\Users\Admin\AppData\Local\Temp\dxzojyuyzr.tc3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\hideggu.exe"C:\Users\Admin\AppData\Local\Temp\hideggu.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4372
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dxzojyuyzr.tc
- Size 5KB
- SHA256 fa0fdbfe1586bea95a6d6ead2c7ea73d1a3b399e06dc2c7e35b4eb7b5f69dcda
- MD5 b4d217d48719de23cda70c0d6092eac3
- SHA1 e8ae7fc69a1f8f13e84a1481d42248337ba9cf0d
- SHA512 ff9deef257676a9aafd7ed3592eaa7107eb4bea568a8f278c3c199a649c8744ee408422f1f43d19ea5cf3a16bac7bded6ed7a43415cd54039e15626e89d9ddf1
- SSDEEP 96:Farc6oY2g/DrYuuk2XO5oSwsHcWtxdGKGElW+cCV76ndoT1A0D0RnTohtC8BauH9:FarcRGmhX1Sh8abGVElv3VW2l60tC8M0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hideggu.exe
- Size 7KB
- SHA256 b7bd0f6e737e281c3f9aebfc16d20911fd5bc7aa8d3febfccfedfda8dcbe0aba
- MD5 cb776f77add469dba201d11fc9560ea6
- SHA1 2d966017ffed19d4e79f8147d067ddd075fec9a6
- SHA512 26300d0d4bc2c153ea8ac12994d4a18919b970792abe434fa1e244daf1f35e91c3ba4fee0709cc532e4cf2141ceb1b724eaf25d3822d8169050cb1f01f0d03a3
- SSDEEP 96:Eo+8cImJTPymL/Zz0o/ZHPtboyn34R16cP4F+Y:Eobbgem/Zz5/ZHP1oyng3P4F+Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hideggu.exe
- Size 7KB
- SHA256 b7bd0f6e737e281c3f9aebfc16d20911fd5bc7aa8d3febfccfedfda8dcbe0aba
- MD5 cb776f77add469dba201d11fc9560ea6
- SHA1 2d966017ffed19d4e79f8147d067ddd075fec9a6
- SHA512 26300d0d4bc2c153ea8ac12994d4a18919b970792abe434fa1e244daf1f35e91c3ba4fee0709cc532e4cf2141ceb1b724eaf25d3822d8169050cb1f01f0d03a3
- SSDEEP 96:Eo+8cImJTPymL/Zz0o/ZHPtboyn34R16cP4F+Y:Eobbgem/Zz5/ZHP1oyng3P4F+Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hideggu.exe
- Size 7KB
- SHA256 b7bd0f6e737e281c3f9aebfc16d20911fd5bc7aa8d3febfccfedfda8dcbe0aba
- MD5 cb776f77add469dba201d11fc9560ea6
- SHA1 2d966017ffed19d4e79f8147d067ddd075fec9a6
- SHA512 26300d0d4bc2c153ea8ac12994d4a18919b970792abe434fa1e244daf1f35e91c3ba4fee0709cc532e4cf2141ceb1b724eaf25d3822d8169050cb1f01f0d03a3
- SSDEEP 96:Eo+8cImJTPymL/Zz0o/ZHPtboyn34R16cP4F+Y:Eobbgem/Zz5/ZHP1oyng3P4F+Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\uyxddusbnfv.z
- Size 205KB
- SHA256 67bb593b1751750a58237d79d04fd0a7a796bdf634fb9e094a8a9fe05180d9fd
- MD5 7498d8b5f41dad6ad960e742139029ba
- SHA1 edbf0917f1cc95fa22ba9c2f3dfda88cade30b2a
- SHA512 161d16ff7cd4043401f466ce02a9f2c875be3a204f8ca6f44e833d47650e2dee66a285f53526931bc73e4818492532365361fdbb32c5d6d7fc5a712d4929e5e7
- SSDEEP 6144:KCVFzbf+yolaZp00rZb39Svxp7IeJLZ9x5EJC10:F+jcZb39Qx1nb9x5LS
- MD5 SHA1 SHA512 SSDEEP