Analysis
- max time kernel
148s - max time network
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 12:11
General
- Target ORDER06979758688485868584.hta
- Size 1.2MB
- Sample260707-pc3ryaev5p
- SHA256 b45b8a643cfb44a8f41fe428632d6628ba6b58ba7da1c38ce8c7d5c63dfbb988
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\ORDER06979758688485868584.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp996165.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp996165.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp996165.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 926⤵
- Program crash
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 2363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2744 -ip 27441⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
tmp996165.bat
tmp996165.bat.gz
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/1680-8-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/1680-19-0x0000000007EE0000-0x000000000849A000-memory.dmp
memory/1680-11-0x0000000005F20000-0x0000000005F3E000-memory.dmp
memory/1680-12-0x0000000005F80000-0x0000000005FCC000-memory.dmp
memory/1680-13-0x0000000007860000-0x0000000007EDC000-memory.dmp
memory/1680-14-0x0000000006480000-0x000000000649A000-memory.dmp
memory/1680-1-0x00000000709A2000-0x00000000709A3000-memory.dmp
memory/1680-17-0x00000000071E0000-0x0000000007276000-memory.dmp
memory/1680-18-0x0000000006F30000-0x0000000006F52000-memory.dmp
memory/1680-10-0x0000000005AE0000-0x0000000005E3B000-memory.dmp
memory/1680-21-0x0000000070990000-0x000000007114C000-memory.dmp
memory/1680-6-0x0000000005930000-0x0000000005996000-memory.dmp
memory/1680-2-0x0000000002A40000-0x0000000002A76000-memory.dmp
memory/1680-5-0x00000000057C0000-0x00000000057E2000-memory.dmp
memory/1680-3-0x0000000070990000-0x000000007114C000-memory.dmp
memory/1680-4-0x0000000005170000-0x00000000057BA000-memory.dmp
memory/2172-29-0x0000000006A60000-0x0000000006AAC000-memory.dmp
memory/2172-27-0x0000000006040000-0x000000000639B000-memory.dmp
memory/2744-44-0x0000000000160000-0x00000000001AE000-memory.dmp