5d03aa31e99aec7138033b75ccac3012336305861abfca05d5a55e9d78476879

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER099737723474PO7273.exe
Size

457KB
MD5

53266aed4a13d86143ce3f08c899ad58
SHA1

f0b7d826d3aa004dde798ff6ada74df96bc8b542
SHA256

5d03aa31e99aec7138033b75ccac3012336305861abfca05d5a55e9d78476879
SHA512

e9b65450ab0472c9a75d993d11c5daa3cc52c92ab388c022a82cad404b5009a596121f9e9a41fb162b62e5b748f0220dd03ec4f25293acfba581824269560427
SSDEEP

12288:d1T9qm2ynBT0X9is7bqZmp8+4WHAImLmHnN:79qm2yCEs6Of4e6mHN

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2724 powershell.exe
Loads dropped DLL 1 IoCs

Processes:

ORDER099737723474PO7273.exe

pid process

1820 ORDER099737723474PO7273.exe
Drops file in Windows directory 1 IoCs

Processes:

ORDER099737723474PO7273.exe

description ioc process

File opened for modification C:\Windows\Fonts\kastura.ang ORDER099737723474PO7273.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2724 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2724 powershell.exe

pid	process
2724	powershell.exe

pid	process
1820	ORDER099737723474PO7273.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\kastura.ang	ORDER099737723474PO7273.exe

pid	process
2724	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2724	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ORDER099737723474PO7273.exe

description	pid	process	target process
PID 1820 wrote to memory of 2724	1820	ORDER099737723474PO7273.exe	powershell.exe
PID 1820 wrote to memory of 2724	1820	ORDER099737723474PO7273.exe	powershell.exe
PID 1820 wrote to memory of 2724	1820	ORDER099737723474PO7273.exe	powershell.exe
PID 1820 wrote to memory of 2724	1820	ORDER099737723474PO7273.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\ORDER099737723474PO7273.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER099737723474PO7273.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Exencephalous=Get-Content 'C:\Users\Admin\AppData\Local\transmarine\Fjerdragts.Yod';$Minuteman=$Exencephalous.SubString(55638,3);.$Minuteman($Exencephalous)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy206D.tmp\nsExec.dll
Filesize
6KB

MD5
143e45d5929ba564ba0c3a0773be76e6

SHA1
c7e108ad681dd19afc646a43f7ce757388653f57

SHA256
8459feb67b7eb0caaaed607e0f36c8d4979abf1bad87e7f1c7c2b97c73174d6d

SHA512
1114403b9af202396ffe32610e1160313ff22c488f87b4a8f771d14fda02a954af7beacad5655143dafdf0af9a76b2a0d5c121ef57819e0567c367578482f003

Download Submit
memory/2724-25-0x0000000073C51000-0x0000000073C52000-memory.dmp

Filesize
4KB

Download
memory/2724-26-0x0000000073C50000-0x00000000741FB000-memory.dmp

Filesize
5.7MB

Download
memory/2724-27-0x0000000073C50000-0x00000000741FB000-memory.dmp

Filesize
5.7MB

Download
memory/2724-28-0x0000000073C50000-0x00000000741FB000-memory.dmp

Filesize
5.7MB

Download
memory/2724-29-0x0000000073C50000-0x00000000741FB000-memory.dmp

Filesize
5.7MB

Download