ab08b3b1fe0ef92d0f112ab2d85303ce7cb12f1c06cda7e288c403e6d9c6312e

General

Target
new_order_list_1805020230000000000000.exe
Size 1.2MB
Sample230519-ldly2ada92
SHA256 ab08b3b1fe0ef92d0f112ab2d85303ce7cb12f1c06cda7e288c403e6d9c6312e
MD5 2a7bd91cd742426a77c9c744b449ee84
SHA1 ef3bea6519980767b272ec5baf79d153ff0c0a7f
SHA512 3a8ce8937e00702bfefa139decd6bb7247f45a018a128a90ad2f4d1166374a38754b6c513514bce1f22d5e45fdf0f46e0641d0259dfbc145b364448cc1b462be
SSDEEP 12288:VLhIlti7/gmmAPanezgj9SliYwxA/t7CzSAx7dVREbmf+XXGG57qY4HW0RDLvql/:VLhhaeKcidG5IMJilsnsp2xp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	new_order_list_1805020230000000000000.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	new_order_list_1805020230000000000000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	new_order_list_1805020230000000000000.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 1436	1764	new_order_list_1805020230000000000000.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
856	powershell.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1764	new_order_list_1805020230000000000000.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe
1436	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	1764	new_order_list_1805020230000000000000.exe
Token: SeDebugPrivilege	1436	jsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 856	1764	new_order_list_1805020230000000000000.exe	28
PID 1764 wrote to memory of 856	1764	new_order_list_1805020230000000000000.exe	28
PID 1764 wrote to memory of 856	1764	new_order_list_1805020230000000000000.exe	28
PID 1764 wrote to memory of 1624	1764	new_order_list_1805020230000000000000.exe	30
PID 1764 wrote to memory of 1624	1764	new_order_list_1805020230000000000000.exe	30
PID 1764 wrote to memory of 1624	1764	new_order_list_1805020230000000000000.exe	30
PID 1764 wrote to memory of 1668	1764	new_order_list_1805020230000000000000.exe	31
PID 1764 wrote to memory of 1668	1764	new_order_list_1805020230000000000000.exe	31
PID 1764 wrote to memory of 1668	1764	new_order_list_1805020230000000000000.exe	31
PID 1764 wrote to memory of 1596	1764	new_order_list_1805020230000000000000.exe	32
PID 1764 wrote to memory of 1596	1764	new_order_list_1805020230000000000000.exe	32
PID 1764 wrote to memory of 1596	1764	new_order_list_1805020230000000000000.exe	32
PID 1764 wrote to memory of 1812	1764	new_order_list_1805020230000000000000.exe	33
PID 1764 wrote to memory of 1812	1764	new_order_list_1805020230000000000000.exe	33
PID 1764 wrote to memory of 1812	1764	new_order_list_1805020230000000000000.exe	33
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34
PID 1764 wrote to memory of 1436	1764	new_order_list_1805020230000000000000.exe	34

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	new_order_list_1805020230000000000000.exe

C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe
"C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:1668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:1596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436