4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301

General

Target

New_Order_PO-NG57283H9.exe
Size

811KB
MD5

2ce9ed0f21ef1669c62448d6513b9c72
SHA1

31302d7550f3d118aaf62414157b7f1c5ff01459
SHA256

4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301
SHA512

83aa83155d7222e2305a7eaf236a70ee2423df676d3b992abff20476b1d7c367e8fd32d88ca96d5dd20945c4b7cc87a0800830da8c7ab9056e7ab0d12e232d8d
SSDEEP

12288:DcsCELA+12Hd5lpvS36pDfi/xN3xT6xbzlYVzxWW1oStiKqisv8yroNee50EEAH7:0zlEzxW22vvo0I

Score

8^/10

collection discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2692 powershell.exe
2904 powershell.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2692	powershell.exe
2904	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

New_Order_PO-NG57283H9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Order_PO-NG57283H9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Order_PO-NG57283H9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Order_PO-NG57283H9.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

New_Order_PO-NG57283H9.exe

description pid process target process

PID 2772 set thread context of 2932 2772 New_Order_PO-NG57283H9.exe New_Order_PO-NG57283H9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2772 set thread context of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

New_Order_PO-NG57283H9.exepowershell.exepowershell.exeschtasks.exeNew_Order_PO-NG57283H9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Order_PO-NG57283H9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Order_PO-NG57283H9.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2804 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

New_Order_PO-NG57283H9.exepowershell.exepowershell.exeNew_Order_PO-NG57283H9.exe

pid process

2772 New_Order_PO-NG57283H9.exe
2772 New_Order_PO-NG57283H9.exe
2904 powershell.exe
2692 powershell.exe
2932 New_Order_PO-NG57283H9.exe

pid	process
2804	schtasks.exe

pid	process
2772	New_Order_PO-NG57283H9.exe
2772	New_Order_PO-NG57283H9.exe
2904	powershell.exe
2692	powershell.exe
2932	New_Order_PO-NG57283H9.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

New_Order_PO-NG57283H9.exeNew_Order_PO-NG57283H9.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2772	New_Order_PO-NG57283H9.exe
Token: SeDebugPrivilege	2932	New_Order_PO-NG57283H9.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

New_Order_PO-NG57283H9.exe

description	pid	process	target process
PID 2772 wrote to memory of 2904	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2904	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2904	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2904	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2692	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2692	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2692	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2692	2772	New_Order_PO-NG57283H9.exe	powershell.exe
PID 2772 wrote to memory of 2804	2772	New_Order_PO-NG57283H9.exe	schtasks.exe
PID 2772 wrote to memory of 2804	2772	New_Order_PO-NG57283H9.exe	schtasks.exe
PID 2772 wrote to memory of 2804	2772	New_Order_PO-NG57283H9.exe	schtasks.exe
PID 2772 wrote to memory of 2804	2772	New_Order_PO-NG57283H9.exe	schtasks.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe
PID 2772 wrote to memory of 2932	2772	New_Order_PO-NG57283H9.exe	New_Order_PO-NG57283H9.exe

outlook_office_path 1 IoCs

Processes:

New_Order_PO-NG57283H9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Order_PO-NG57283H9.exe

outlook_win_path 1 IoCs

Processes:

New_Order_PO-NG57283H9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Order_PO-NG57283H9.exe

C:\Users\Admin\AppData\Local\Temp\New_Order_PO-NG57283H9.exe
"C:\Users\Admin\AppData\Local\Temp\New_Order_PO-NG57283H9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New_Order_PO-NG57283H9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fYijjUPqxJQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fYijjUPqxJQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84E9.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\New_Order_PO-NG57283H9.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Order_PO-NG57283H9.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp84E9.tmp

Filesize
1KB

MD5
41b58190ab396a3f5c505b70d8f4734e

SHA1
46b33376d3ac3a9f2907bc7b273b8bbf990071e7

SHA256
61dee4f20291b04b50cb08ad8f851602e984a24b9c5b87c987400cd89ec99999

SHA512
fc02229199b0cdb39c762d48f487fddc75d5212856ef1663cdafca3ae02e83154e860046f516ac02ee1865703f65dedbfa23364400bf08ed777b0f9db7726c43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
981d77f2f9f37c017e338b5d79bd0b1c

SHA1
efc36e5a5eb65014dafca1e047623bfa0d38f61d

SHA256
9bc5da1a6af1d49f05836da694571437ffb515b06926e8fd3bac8c5b16c7df5e

SHA512
c56b7f522a741ebb7e0fbeffcd6458e1bfaf05aa097cb1cd677a892835be30a2f32085cd025466ded6d5466ef6e6039f63554e8304dffb0a2256304abea8c320

Download Submit
memory/2772-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2772-32-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2772-5-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-6-0x0000000004ED0000-0x0000000004F32000-memory.dmp

Filesize
392KB

Download
memory/2772-2-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-1-0x0000000000D00000-0x0000000000DD2000-memory.dmp

Filesize
840KB

Download
memory/2772-3-0x00000000008D0000-0x00000000008E2000-memory.dmp

Filesize
72KB

Download
memory/2932-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-31-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2932-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads