Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18/04/2023, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
PO 278198726- New Order.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO 278198726- New Order.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
PO 278198726- New Order.exe
-
Size
690KB
-
MD5
17809ada8c8f037b1fe8a428904cc6b6
-
SHA1
7f0fb69877f1190050a4a0193ac6b5a6cdec2b57
-
SHA256
007a3cbf2cfa788261a8475ccea642bf097870996cf002bc6720d7edc63d25e6
-
SHA512
8782f028edc9827947fb12c55466cc26c7bd0447526cc1a7c1b99f71a1102ab3fd7eb4d9472ee6f12632ce2940ddeef0c94691a26423dbdea23eddeba1b3ab4f
-
SSDEEP
12288:MQ7PCFKYTzAGTrNXTOHqPW3f0CEtcxf6q3dox3pj7AC5OScPPGFMWDPpt:d7EKcrNyz3I2i8CkP4McPpt
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\653hytddfggyhiky.lnk PO 278198726- New Order.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\653hytddfggyhiky.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\653hytddfggyhiky.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1424 PING.EXE 864 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe 1308 PO 278198726- New Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1308 PO 278198726- New Order.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1308 wrote to memory of 844 1308 PO 278198726- New Order.exe 28 PID 1308 wrote to memory of 844 1308 PO 278198726- New Order.exe 28 PID 1308 wrote to memory of 844 1308 PO 278198726- New Order.exe 28 PID 1308 wrote to memory of 844 1308 PO 278198726- New Order.exe 28 PID 844 wrote to memory of 1424 844 cmd.exe 30 PID 844 wrote to memory of 1424 844 cmd.exe 30 PID 844 wrote to memory of 1424 844 cmd.exe 30 PID 844 wrote to memory of 1424 844 cmd.exe 30 PID 844 wrote to memory of 864 844 cmd.exe 31 PID 844 wrote to memory of 864 844 cmd.exe 31 PID 844 wrote to memory of 864 844 cmd.exe 31 PID 844 wrote to memory of 864 844 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 278198726- New Order.exe"C:\Users\Admin\AppData\Local\Temp\PO 278198726- New Order.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 40 > nul && copy "C:\Users\Admin\AppData\Local\Temp\PO 278198726- New Order.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\653hytddfggyhiky.exe" && ping 127.0.0.1 -n 40 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\653hytddfggyhiky.exe"2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 403⤵
- Runs ping.exe
PID:1424
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 403⤵
- Runs ping.exe
PID:864
-
-