574f46006cfd1caa512756f6a27e6ce2140124d77f1a979c2c12d0d63652cd5c

Analysis

max time kernel
142s
max time network
71s
platform
windows7_x64
resource
win7
submitted
14/08/2020, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order.exe
Size 939KB
Sample200814-jkyqxy7bme
SHA256 574f46006cfd1caa512756f6a27e6ce2140124d77f1a979c2c12d0d63652cd5c
MD5 e473e0d02609c994b68fbcf14d73698a
SHA1 5a676329d7ccb0a0e06b516553f0e05f4de820ca
SHA512 2d0ca8345095efeebf9def16261360e16dcbaf0b9c60e76be372f5fd5edb337fb935f7ec0c1215370a1a2ca0765e94c6695ae9ca102d7de7fc771c704ba72d82
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1076	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1172	1080	order.exe	24
PID 1080 wrote to memory of 1172	1080	order.exe	24
PID 1080 wrote to memory of 1172	1080	order.exe	24
PID 1080 wrote to memory of 1172	1080	order.exe	24
PID 1172 wrote to memory of 1076	1172	cmd.exe	26
PID 1172 wrote to memory of 1076	1172	cmd.exe	26
PID 1172 wrote to memory of 1076	1172	cmd.exe	26
PID 1172 wrote to memory of 1076	1172	cmd.exe	26
PID 1080 wrote to memory of 1428	1080	order.exe	27
PID 1080 wrote to memory of 1428	1080	order.exe	27
PID 1080 wrote to memory of 1428	1080	order.exe	27
PID 1080 wrote to memory of 1428	1080	order.exe	27
PID 1080 wrote to memory of 1436	1080	order.exe	28
PID 1080 wrote to memory of 1436	1080	order.exe	28
PID 1080 wrote to memory of 1436	1080	order.exe	28
PID 1080 wrote to memory of 1436	1080	order.exe	28
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1452	1436	order.exe	29
PID 1436 wrote to memory of 1516	1436	order.exe	30
PID 1436 wrote to memory of 1516	1436	order.exe	30
PID 1436 wrote to memory of 1516	1436	order.exe	30
PID 1436 wrote to memory of 1516	1436	order.exe	30
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 292	1516	order.exe	31
PID 1516 wrote to memory of 296	1516	order.exe	32
PID 1516 wrote to memory of 296	1516	order.exe	32
PID 1516 wrote to memory of 296	1516	order.exe	32
PID 1516 wrote to memory of 296	1516	order.exe	32
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 672	296	order.exe	33
PID 296 wrote to memory of 788	296	order.exe	34
PID 296 wrote to memory of 788	296	order.exe	34
PID 296 wrote to memory of 788	296	order.exe	34
PID 296 wrote to memory of 788	296	order.exe	34
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37
PID 788 wrote to memory of 1788	788	order.exe	37

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN purchase list /XML "C:\Users\Admin\AppData\Local\Temp\c9b9b8af022a4b269584b794e5506841.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN purchase list /XML "C:\Users\Admin\AppData\Local\Temp\c9b9b8af022a4b269584b794e5506841.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  PID:1428
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\order.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\order.exe"
      4⤵
      PID:292
  - - C:\Users\Admin\AppData\Local\Temp\order.exe
      "C:\Users\Admin\AppData\Local\Temp\order.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        5⤵
        
        PID:672
    - - C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:788
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        6⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        6⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        7⤵
        
        PID:1584
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        8⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        8⤵
        
        PID:1652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        9⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        9⤵
        
        PID:1556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        10⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        10⤵
        
        PID:1920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        11⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        11⤵
        
        PID:1908
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        12⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        12⤵
        
        PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads