Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01-10-2024 05:02
General
-
Target
po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe
-
Size
618KB
-
MD5
43523528dffe8705862304986c04665d
-
SHA1
d94e95afbbd1ae578ceff278ade301ebd7dfbdf6
-
SHA256
822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892
-
SHA512
b6ad05059763d326c4e0e799ff1324ac141c1a5f4e443b2ca07de643dc80daec5860cb40f1c400b3e9ada6bd319aebc805b4dbda1924aad31b0014e2440e79d8
-
SSDEEP
12288:Wa27wCe1S4QKMVkdg0uUG3DgIdGztFeQDHVxE:p2MCeL7eKG8IdOF/7E
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 11922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1384 -ip 13841⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 11922⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 11882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4016 -ip 40161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4032 -ip 40321⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5e5ba60efaefd99c23ee15ea20d9a69f3
SHA120b39aa7484ee4e81a783f55f016f0c144fc46ca
SHA256b4ec66f794966a8fad320eee8a0c5a894e787f85a937472ad83f55961713c4a5
SHA5128c6fca5cedc7b1184b2ebc7c6f142b79f3b78c0c7d488145b447258b4dd8301ccedda5e6524deb8ea360dc11f28e835ca6da042aefafc73e0c8e6e37553e6d64
-
Filesize
18KB
MD5ee7f60917be0216291fc9835970d3a83
SHA1bd719132d67b6676a2b583fb7a34833561fd16b2
SHA256cb4ecae854f1f005694dd5d862e7ba0efe36fb6d37fb8f272e0c57bbd3ded35e
SHA5128675d8e4b1bd4d2806858979beb944571c0056cfbf7ab2ef081c88ab6b986d28bc9be44e993da3ec0f569d398439780bab1bc6c3cea347ab9bda6d1511a85f57
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
-
Filesize
640KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
416KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
80KB