Analysis
- max time kernel
135s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2023, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
new_order_list_1805020230000000000000.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
General
- Target new_order_list_1805020230000000000000.exe
- Size 1.2MB
- Sample230519-ldly2ada92
- SHA256 ab08b3b1fe0ef92d0f112ab2d85303ce7cb12f1c06cda7e288c403e6d9c6312e
- MD5 2a7bd91cd742426a77c9c744b449ee84
- SHA1 ef3bea6519980767b272ec5baf79d153ff0c0a7f
- SHA512 3a8ce8937e00702bfefa139decd6bb7247f45a018a128a90ad2f4d1166374a38754b6c513514bce1f22d5e45fdf0f46e0641d0259dfbc145b364448cc1b462be
- SSDEEP 12288:VLhIlti7/gmmAPanezgj9SliYwxA/t7CzSAx7dVREbmf+XXGG57qY4HW0RDLvql/:VLhhaeKcidG5IMJilsnsp2xp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" new_order_list_1805020230000000000000.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths new_order_list_1805020230000000000000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe = "0" new_order_list_1805020230000000000000.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation new_order_list_1805020230000000000000.exe - Uses the VBS compiler for execution 1 TTPs
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths new_order_list_1805020230000000000000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions new_order_list_1805020230000000000000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe = "0" new_order_list_1805020230000000000000.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA new_order_list_1805020230000000000000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" new_order_list_1805020230000000000000.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 1820 powershell.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 1820 powershell.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe 4644 new_order_list_1805020230000000000000.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4644 new_order_list_1805020230000000000000.exe Token: SeDebugPrivilege 1820 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1820 4644 new_order_list_1805020230000000000000.exe 84 PID 4644 wrote to memory of 1820 4644 new_order_list_1805020230000000000000.exe 84 PID 4644 wrote to memory of 3188 4644 new_order_list_1805020230000000000000.exe 86 PID 4644 wrote to memory of 3188 4644 new_order_list_1805020230000000000000.exe 86 PID 4644 wrote to memory of 1844 4644 new_order_list_1805020230000000000000.exe 87 PID 4644 wrote to memory of 1844 4644 new_order_list_1805020230000000000000.exe 87 PID 4644 wrote to memory of 3204 4644 new_order_list_1805020230000000000000.exe 88 PID 4644 wrote to memory of 3204 4644 new_order_list_1805020230000000000000.exe 88 PID 4644 wrote to memory of 3940 4644 new_order_list_1805020230000000000000.exe 89 PID 4644 wrote to memory of 3940 4644 new_order_list_1805020230000000000000.exe 89 PID 4644 wrote to memory of 3924 4644 new_order_list_1805020230000000000000.exe 90 PID 4644 wrote to memory of 3924 4644 new_order_list_1805020230000000000000.exe 90 PID 4644 wrote to memory of 3192 4644 new_order_list_1805020230000000000000.exe 91 PID 4644 wrote to memory of 3192 4644 new_order_list_1805020230000000000000.exe 91 PID 4644 wrote to memory of 2480 4644 new_order_list_1805020230000000000000.exe 92 PID 4644 wrote to memory of 2480 4644 new_order_list_1805020230000000000000.exe 92 PID 4644 wrote to memory of 2480 4644 new_order_list_1805020230000000000000.exe 92 PID 4644 wrote to memory of 2456 4644 new_order_list_1805020230000000000000.exe 93 PID 4644 wrote to memory of 2456 4644 new_order_list_1805020230000000000000.exe 93 PID 4644 wrote to memory of 1344 4644 new_order_list_1805020230000000000000.exe 94 PID 4644 wrote to memory of 1344 4644 new_order_list_1805020230000000000000.exe 94 PID 4644 wrote to memory of 2684 4644 new_order_list_1805020230000000000000.exe 98 PID 4644 wrote to memory of 2684 4644 new_order_list_1805020230000000000000.exe 98 PID 4644 wrote to memory of 232 4644 new_order_list_1805020230000000000000.exe 95 PID 4644 wrote to memory of 232 4644 new_order_list_1805020230000000000000.exe 95 PID 4644 wrote to memory of 3784 4644 new_order_list_1805020230000000000000.exe 97 PID 4644 wrote to memory of 3784 4644 new_order_list_1805020230000000000000.exe 97 PID 4644 wrote to memory of 4160 4644 new_order_list_1805020230000000000000.exe 96 PID 4644 wrote to memory of 4160 4644 new_order_list_1805020230000000000000.exe 96 PID 4644 wrote to memory of 4316 4644 new_order_list_1805020230000000000000.exe 99 PID 4644 wrote to memory of 4316 4644 new_order_list_1805020230000000000000.exe 99 PID 4644 wrote to memory of 4704 4644 new_order_list_1805020230000000000000.exe 100 PID 4644 wrote to memory of 4704 4644 new_order_list_1805020230000000000000.exe 100 PID 4644 wrote to memory of 4640 4644 new_order_list_1805020230000000000000.exe 101 PID 4644 wrote to memory of 4640 4644 new_order_list_1805020230000000000000.exe 101 PID 4644 wrote to memory of 1440 4644 new_order_list_1805020230000000000000.exe 107 PID 4644 wrote to memory of 1440 4644 new_order_list_1805020230000000000000.exe 107 PID 4644 wrote to memory of 1724 4644 new_order_list_1805020230000000000000.exe 106 PID 4644 wrote to memory of 1724 4644 new_order_list_1805020230000000000000.exe 106 PID 4644 wrote to memory of 2512 4644 new_order_list_1805020230000000000000.exe 104 PID 4644 wrote to memory of 2512 4644 new_order_list_1805020230000000000000.exe 104 PID 4644 wrote to memory of 1688 4644 new_order_list_1805020230000000000000.exe 103 PID 4644 wrote to memory of 1688 4644 new_order_list_1805020230000000000000.exe 103 PID 4644 wrote to memory of 1968 4644 new_order_list_1805020230000000000000.exe 102 PID 4644 wrote to memory of 1968 4644 new_order_list_1805020230000000000000.exe 102 PID 4644 wrote to memory of 3608 4644 new_order_list_1805020230000000000000.exe 105 PID 4644 wrote to memory of 3608 4644 new_order_list_1805020230000000000000.exe 105 PID 4644 wrote to memory of 3120 4644 new_order_list_1805020230000000000000.exe 108 PID 4644 wrote to memory of 3120 4644 new_order_list_1805020230000000000000.exe 108 PID 4644 wrote to memory of 444 4644 new_order_list_1805020230000000000000.exe 109 PID 4644 wrote to memory of 444 4644 new_order_list_1805020230000000000000.exe 109 PID 4644 wrote to memory of 4608 4644 new_order_list_1805020230000000000000.exe 110 PID 4644 wrote to memory of 4608 4644 new_order_list_1805020230000000000000.exe 110 PID 4644 wrote to memory of 2392 4644 new_order_list_1805020230000000000000.exe 111 PID 4644 wrote to memory of 2392 4644 new_order_list_1805020230000000000000.exe 111 PID 4644 wrote to memory of 1588 4644 new_order_list_1805020230000000000000.exe 112 PID 4644 wrote to memory of 1588 4644 new_order_list_1805020230000000000000.exe 112 PID 4644 wrote to memory of 1172 4644 new_order_list_1805020230000000000000.exe 113 PID 4644 wrote to memory of 1172 4644 new_order_list_1805020230000000000000.exe 113 PID 4644 wrote to memory of 1068 4644 new_order_list_1805020230000000000000.exe 114 PID 4644 wrote to memory of 1068 4644 new_order_list_1805020230000000000000.exe 114 PID 4644 wrote to memory of 3360 4644 new_order_list_1805020230000000000000.exe 115 PID 4644 wrote to memory of 3360 4644 new_order_list_1805020230000000000000.exe 115 PID 4644 wrote to memory of 1040 4644 new_order_list_1805020230000000000000.exe 116 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" new_order_list_1805020230000000000000.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe"C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\new_order_list_1805020230000000000000.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:3188
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:1844
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:3204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:3940
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:3924
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:3192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:2480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:2456
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:1344
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵PID:232
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:4160
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:3784
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵PID:2684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"2⤵PID:4316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:4704
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:4640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵PID:1968
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵PID:1688
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2512
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:3608
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:1724
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:1440
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:3120
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:444
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵PID:4608
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:2392
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:1172
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:1068
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:3360
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:1040
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ceqfcfcj.wem.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512