Analysis
-
max time kernel
10s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 17:09
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order Purchase Order Purchase Order Purchase Order.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Purchase Order Purchase Order Purchase Order Purchase Order.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Purchase Order Purchase Order Purchase Order Purchase Order.exe
-
Size
707KB
-
MD5
b9a03fb0c2c7f23a1e4ccb0d79c5053c
-
SHA1
4d87c4ed89d8b92f2b6849dc6af6a8850f8e5e7c
-
SHA256
099369eb025c3e23b6669c872ac2572e7bc4ba9200eb4d6318284983ddb78e3f
-
SHA512
7b39c7eb08b12f947a2f5fb79f91a7c8fb738fa14c2539db55f207754438f5b340d5ae5219ec1ea6861cb72aad32e04d2b701cc6a34c098e0a780db3607be3d2
-
SSDEEP
12288:d35ol8MJEBhQRtZZbhhLSbWJgU8UFJ6UibZP9/I7TAWWtQnm:d3kJEBORt7b3Oa2Udi9P9yTB0Qnm
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 576 Purchase Order Purchase Order Purchase Order Purchase Order.exe 576 Purchase Order Purchase Order Purchase Order Purchase Order.exe 576 Purchase Order Purchase Order Purchase Order Purchase Order.exe 576 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\nomarch\gratiales.ini Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\Gullis.lnk Purchase Order Purchase Order Purchase Order Purchase Order.exe File opened for modification C:\Windows\Fonts\Gullis.lnk Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purchase Order Purchase Order Purchase Order Purchase Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58f5e97bec31ba620de606572477e4fe4
SHA16bf85b18bae07ea01b7e86d920e7a79934f25dc9
SHA256ae283a49666fda34720d04864335014f48053b67b9e6eb39b7907a865db3ac10
SHA512352600d4e86338bfc06bb53d4b772b4a240f82c00fe3e2ad9063560165b8164de0c8a218fed8b740342f93c6e342d133ede6e20f435f8663f870f39bf3020e1d
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4