Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 16:42
Static task
static1
Behavioral task
behavioral1
Sample
ORDER.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ORDER.exe
Resource
win10v2004-20231127-en
General
-
Target
ORDER.exe
-
Size
830KB
-
MD5
985225f6ec19a166c50bd5d0e16d330f
-
SHA1
9022950aa9cef1cc010c636a97b229e30d0002b0
-
SHA256
82cb6a221ee2b2c0c0f43139765407c713ff6980d966544f71f351c66928a4da
-
SHA512
a4d5576cc36994ae0d6bfa0545961370f429bd8a4e875a65e77f6f4cf522dbf1fa82fb5491b593f26178a6a27c8c1b54214b06c29b43a6c2e09908ab4361d5a0
-
SSDEEP
24576:koPOk+pJZDI7EeT/ZhOX0IAmQeY14VDjh:nyJ6ZT/Zh3IAmQ5qD
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
ORDER.exepowershell.exepid process 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2440 ORDER.exe 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER.exepowershell.exedescription pid process Token: SeDebugPrivilege 2440 ORDER.exe Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ORDER.exedescription pid process target process PID 2440 wrote to memory of 2632 2440 ORDER.exe powershell.exe PID 2440 wrote to memory of 2632 2440 ORDER.exe powershell.exe PID 2440 wrote to memory of 2632 2440 ORDER.exe powershell.exe PID 2440 wrote to memory of 2632 2440 ORDER.exe powershell.exe PID 2440 wrote to memory of 2696 2440 ORDER.exe schtasks.exe PID 2440 wrote to memory of 2696 2440 ORDER.exe schtasks.exe PID 2440 wrote to memory of 2696 2440 ORDER.exe schtasks.exe PID 2440 wrote to memory of 2696 2440 ORDER.exe schtasks.exe PID 2440 wrote to memory of 2936 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2936 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2936 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2936 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2720 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2720 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2720 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2720 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2728 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2728 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2728 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2728 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2496 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2496 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2496 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2496 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2088 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2088 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2088 2440 ORDER.exe ORDER.exe PID 2440 wrote to memory of 2088 2440 ORDER.exe ORDER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vaTUux.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vaTUux" /XML "C:\Users\Admin\AppData\Local\Temp\tmp953D.tmp"2⤵
- Creates scheduled task(s)
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\ORDER.exe"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"2⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD521fbaeca42a82852e57e4250eab6e005
SHA1371e1d14b0d387727acd22e2a5c0a4deaec3bf9a
SHA25619b4b8c66d9d9fdf927f38d8408184812a6623f238ce95674478e37d0cfd99a3
SHA5128a7e1421c2b96e8845d6d7f24933fceb0b17b9998ae181bb6fd66e39a074f8c5c91aae2bdf0d78c44c7a553696dda561b6a27440f65c8c9185988888cc9552a3