e1ca4ebe98669aba256938d03fe22b46e8b17211a3f01c1e598774c444a9816f

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order.exe
Size 1.2MB
Sample240625-bmsstssejb
SHA256 e1ca4ebe98669aba256938d03fe22b46e8b17211a3f01c1e598774c444a9816f
MD5 a456fa012d00c900d6fa7b987cdc4e74
SHA1 19fadca30660e7b7ff34009003dd8c667000d0e4
SHA512 471a60b96aac2ce50abf96552808fe90857cd82f7213ce19b38c7072b7025a3b2cccbf6c9540ff7d1b8802e88ac4153089137b1eb82d5bc4c3978dd2944b4752
SSDEEP 24576:eAHnh+eWsN3skA4RV1Hom2KXMmHa9MnIHYUYAEp/6GHC5gk935:Jh+ZkldoPK8Ya9dHNEpCGel
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 4448	4844	New Order.exe	80

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3212	4844	WerFault.exe	79
1472	4448	WerFault.exe	80

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4844	New Order.exe
4844	New Order.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4844	New Order.exe
4844	New Order.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4844	New Order.exe
4844	New Order.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4448	4844	New Order.exe	80
PID 4844 wrote to memory of 4448	4844	New Order.exe	80
PID 4844 wrote to memory of 4448	4844	New Order.exe	80
PID 4844 wrote to memory of 4448	4844	New Order.exe	80

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
  2⤵
  PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 196
    3⤵
    - Program crash
    PID:1472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 728
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4448 -ip 4448
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4844 -ip 4844
1⤵
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

aut512D.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut512D.tmp
Size 268KB
SHA256 8a3d842bd4acf5087291dc78902c4b8e0b9d3a9ebfa4429991817ea61011eaa2
MD5 ec414fa68962bc928f267999db7ba581
SHA1 3fa755790789f37280a0cbbf77153d9c234d92ad
SHA512 0ef1359583287dbdeedf117f1ec82620da07b85d36522f3613529488b5fe5c82245afbd46d70c128653c563887baf2c30efb51d55d1b862f2360995d757a8a5d
SSDEEP 6144:AYidbHX4WFLAdhTU39rICOJy4FeJvKhgoQIbehgx9bvq5m:AYidTx4TU9ICtJihVhvq5m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4448-13-0x0000000000320000-0x0000000000363000-memory.dmp

Download

memory/4844-12-0x0000000000980000-0x0000000000984000-memory.dmp