0807202daf2095810fdbc78ccf60ed83368e84da1f89d7215f9bac6590b40b7d

General

Target

order6566546663.exe
Size

643KB
MD5

8a728a201ff4eebc956d8747c0b689e8
SHA1

94fe365f40c34e83e39a4c81c7cf9319d7cfa6cc
SHA256

0807202daf2095810fdbc78ccf60ed83368e84da1f89d7215f9bac6590b40b7d
SHA512

318b968f5ce9a3caf4a2664bcc6c355463ad78fb65c09cb054ac3fd00e65f7ea454bdb7b9577c6743a01c540eca57b6527708a9008926ae8c10737231ac8511b
SSDEEP

12288:ioEP/SJasDrhUVMJ5kjDZCwbX9PblDCkIcxWMB:A/4pDfGDYuRblDC7cxW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

order6566546663.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	order6566546663.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2660 schtasks.exe

pid	process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

order6566546663.exepowershell.exe

pid	process
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
4840	powershell.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
3364	order6566546663.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

order6566546663.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3364 order6566546663.exe
Token: SeDebugPrivilege 4840 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3364	order6566546663.exe
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

order6566546663.exe

description	pid	process	target process
PID 3364 wrote to memory of 4840	3364	order6566546663.exe	powershell.exe
PID 3364 wrote to memory of 4840	3364	order6566546663.exe	powershell.exe
PID 3364 wrote to memory of 4840	3364	order6566546663.exe	powershell.exe
PID 3364 wrote to memory of 2660	3364	order6566546663.exe	schtasks.exe
PID 3364 wrote to memory of 2660	3364	order6566546663.exe	schtasks.exe
PID 3364 wrote to memory of 2660	3364	order6566546663.exe	schtasks.exe
PID 3364 wrote to memory of 3316	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 3316	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 3316	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1644	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1644	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1644	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1532	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1532	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 1532	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 2632	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 2632	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 2632	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 3308	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 3308	3364	order6566546663.exe	order6566546663.exe
PID 3364 wrote to memory of 3308	3364	order6566546663.exe	order6566546663.exe

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKrgNXcYsk.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKrgNXcYsk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2480.tmp"
2⤵
- Creates scheduled task(s)
PID:2660

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
2⤵
PID:3316

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
2⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
2⤵
PID:3308

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
2⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\order6566546663.exe
"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"
2⤵
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylwffkl3.kb4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2480.tmp
Filesize
1KB

MD5
b53d756327e75433717f858a745d8ccc

SHA1
a8b98d5f1bc1d91b75fa6228f33b360f9383099b

SHA256
2a45bdf1966df3806d401f3016c8a94c62b1b0976cfa47a6ffcec939dfefcad2

SHA512
c384e432f7d1ad4b87de682e34150c4a69540254a05115906ce6ae1464ea6e4cc926b723d5240227f94c631ba4b08787bb770d408e0ea7bb2d80ca9f66400803

Download Submit
memory/3364-134-0x0000000005F10000-0x00000000064B4000-memory.dmp

Filesize
5.6MB

Download
memory/3364-135-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/3364-136-0x0000000005930000-0x000000000593A000-memory.dmp

Filesize
40KB

Download
memory/3364-137-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3364-138-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3364-139-0x0000000008B60000-0x0000000008BFC000-memory.dmp

Filesize
624KB

Download
memory/3364-133-0x0000000000E90000-0x0000000000F38000-memory.dmp

Filesize
672KB

Download
memory/4840-144-0x0000000002800000-0x0000000002836000-memory.dmp

Filesize
216KB

Download
memory/4840-164-0x0000000072D80000-0x0000000072DCC000-memory.dmp

Filesize
304KB

Download
memory/4840-149-0x0000000005970000-0x00000000059D6000-memory.dmp

Filesize
408KB

Download
memory/4840-155-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Filesize
408KB

Download
memory/4840-156-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/4840-146-0x0000000005240000-0x0000000005868000-memory.dmp

Filesize
6.2MB

Download
memory/4840-157-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/4840-162-0x0000000006120000-0x000000000613E000-memory.dmp

Filesize
120KB

Download
memory/4840-163-0x00000000066E0000-0x0000000006712000-memory.dmp

Filesize
200KB

Download
memory/4840-147-0x0000000005150000-0x0000000005172000-memory.dmp

Filesize
136KB

Download
memory/4840-174-0x00000000066C0000-0x00000000066DE000-memory.dmp

Filesize
120KB

Download
memory/4840-175-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/4840-176-0x000000007FCE0000-0x000000007FCF0000-memory.dmp

Filesize
64KB

Download
memory/4840-177-0x0000000007A70000-0x00000000080EA000-memory.dmp

Filesize
6.5MB

Download
memory/4840-178-0x0000000007420000-0x000000000743A000-memory.dmp

Filesize
104KB

Download
memory/4840-179-0x00000000074A0000-0x00000000074AA000-memory.dmp

Filesize
40KB

Download
memory/4840-180-0x00000000076A0000-0x0000000007736000-memory.dmp

Filesize
600KB

Download
memory/4840-181-0x0000000007650000-0x000000000765E000-memory.dmp

Filesize
56KB

Download
memory/4840-182-0x0000000007760000-0x000000000777A000-memory.dmp

Filesize
104KB

Download
memory/4840-183-0x0000000007740000-0x0000000007748000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads