Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
01-10-2024 05:02
General
-
Target
po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe
-
Size
618KB
-
MD5
43523528dffe8705862304986c04665d
-
SHA1
d94e95afbbd1ae578ceff278ade301ebd7dfbdf6
-
SHA256
822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892
-
SHA512
b6ad05059763d326c4e0e799ff1324ac141c1a5f4e443b2ca07de643dc80daec5860cb40f1c400b3e9ada6bd319aebc805b4dbda1924aad31b0014e2440e79d8
-
SSDEEP
12288:Wa27wCe1S4QKMVkdg0uUG3DgIdGztFeQDHVxE:p2MCeL7eKG8IdOF/7E
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 8482⤵
- Program crash
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 6802⤵
- Program crash
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\msdt.exe"C:\Windows\system32\msdt.exe" -id MaintenanceDiagnostic -ep ControlPanelSearch1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 7442⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c25da8d9f3f543edb8b8c3ce3f9aad5f
SHA109b488962889b5bd68f9a471f13ee61ac1fec675
SHA2563537e712b8606d3dae9e9e73f4a4f0f0308cf8af5788e6a5044e58e4757dd580
SHA512a9fcd15fa897b61b7e29d277e6afe829296dc1609e8ace36c0cc4658918c74902a7726f2323f1ebade007c380f7aaa3bf68b3cd2cd7cea1b6a6b2ba9b318bad1
-
Filesize
75KB
MD5ed0f4fabdc61648b147cc63f6b358907
SHA19aec944b536dd6bb00e2c3620da2ee7a169bb59c
SHA256b4d33499be459a26afcbe051d293d507e81898deea48b6e11864688dfb1573c8
SHA5127386dc1b5643601c97c8499636f92c2d37c7bb0a3274624f9dc0891144485e7b0b8266c00b5f1958ff75314c2285a85c83bfd57ef48c7d20709a7d004289da51
-
Filesize
7KB
MD5dc9ef61f2f8ec42d28640b1d40739baf
SHA13507d602206e35554f35344a10c4a36d89ec216f
SHA256f444463d34cf23ff6b6ca9d34bd840fa6ee4b2eba6c2156e0f17d7418c8f76b0
SHA51295c826b7461348d2c6305e6295074df2c5eba27a0aeabe1ba3cc1572fbc58070f4cfb9c30466ba8532bca591a99a094fad45b8e01b2a61562a172b9e5e16716c
-
Filesize
640KB
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
416KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
640KB
-
Filesize
640KB