3a04294c74c076d017ac8f59b506f735547d31472f7480cb6652dea5e3a2816c

Analysis

max time kernel
150s
max time network
132s
platform
windows10_x64
resource
win10v20201028
submitted
19-01-2021 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER_LIST.exe
Size

1.1MB
MD5

fa181a9414347d63137af021b2141cd6
SHA1

ccf670892b360b42fa7426de02a3e7629f333841
SHA256

3a04294c74c076d017ac8f59b506f735547d31472f7480cb6652dea5e3a2816c
SHA512

f2415e6563abfb25872b338edb2cc41a1f10a55cc6084c79c026dc4c1cec4bb952a36251b0f2bdde736d019805bfbf3d67f57e01b726d034cecb32984195e821

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1344 schtasks.exe

pid	process
1344	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ORDER_LIST.exe

description	pid	process	target process
PID 3084 wrote to memory of 1344	3084	ORDER_LIST.exe	schtasks.exe
PID 3084 wrote to memory of 1344	3084	ORDER_LIST.exe	schtasks.exe
PID 3084 wrote to memory of 1344	3084	ORDER_LIST.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bEWIuckEckK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7868.tmp"
2⤵
- Creates scheduled task(s)
PID:1344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7868.tmp
MD5
75ba2b661e8059668a62173e92ae6dc0

SHA1
8a7467cd89b5ba8cc6b18ff9758aa99d088a063d

SHA256
25bb9f0bac02c2080f1aaaa0c4ca54f24ceed79b3142d8bab967585d2a5eb2ea

SHA512
b16eeeae572956974318e6c3ac82a2717914d1276898d6b2423d12a6f49f8811eab8e8b185640e1416c46fd93865c4aa7b08509f8a0e73357aaab76e4708feca

Download Submit
memory/1344-13-0x0000000000000000-mapping.dmp

Download
memory/3084-2-0x0000000073940000-0x000000007402E000-memory.dmp

Filesize
6.9MB

Download
memory/3084-3-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/3084-5-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/3084-6-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/3084-7-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/3084-8-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/3084-9-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/3084-10-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/3084-11-0x00000000056C0000-0x00000000056D3000-memory.dmp

Filesize
76KB

Download
memory/3084-12-0x0000000001600000-0x00000000016AD000-memory.dmp

Filesize
692KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads