Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250905-en - resource tags
- submitted
05/10/2025, 11:06
General
- Target additional_samples/orange.exe
- Size 42KB
- Sample251005-m7l2kattht
- SHA256 5b7228947b256f36bd98dde1622799cda8f7a7aa0f3196aba08200fe8439dfee
Score
9/10
Malware Config
Signatures
- Contacts a large (3725) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 4 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\additional_samples\orange.exe"C:\Users\Admin\AppData\Local\Temp\additional_samples\orange.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\intrenat.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
sync-src-1.00.tbz
memory/4552-0-0x0000000000400000-0x000000000040D000-memory.dmp
memory/4552-14-0x0000000000400000-0x000000000040D000-memory.dmp