ec51e50ebea3906ef87c852c95b256e3948a9bb789981a9dd1fe673d78663e66

General

Target
Top Urgent_New_Order_PDF.exe
Size 911KB
Sample210125-ept2tp28pe
SHA256 ec51e50ebea3906ef87c852c95b256e3948a9bb789981a9dd1fe673d78663e66
MD5 f71317984e36770287b066803de0ab00
SHA1 15f8bcac4aa7273f362ad1f474bf818ee5179b44
SHA512 df2dd89cfdbeb05595e1c676adf3736ae8ebedcd3d1cc6ad6b4ea2f20a0d5fb149cab78d6f29c300eebf9e07c883596e1bc5267a561fed19d429c3f10e6989b9
MD5 SHA1 SHA512

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Top Urgent_New_Order_PDF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Top Urgent_New_Order_PDF.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Top Urgent_New_Order_PDF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Top Urgent_New_Order_PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe
1184	Top Urgent_New_Order_PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	Top Urgent_New_Order_PDF.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1084	1184	Top Urgent_New_Order_PDF.exe	30
PID 1184 wrote to memory of 1084	1184	Top Urgent_New_Order_PDF.exe	30
PID 1184 wrote to memory of 1084	1184	Top Urgent_New_Order_PDF.exe	30
PID 1184 wrote to memory of 1084	1184	Top Urgent_New_Order_PDF.exe	30
PID 1184 wrote to memory of 300	1184	Top Urgent_New_Order_PDF.exe	32
PID 1184 wrote to memory of 300	1184	Top Urgent_New_Order_PDF.exe	32
PID 1184 wrote to memory of 300	1184	Top Urgent_New_Order_PDF.exe	32
PID 1184 wrote to memory of 300	1184	Top Urgent_New_Order_PDF.exe	32
PID 1184 wrote to memory of 316	1184	Top Urgent_New_Order_PDF.exe	33
PID 1184 wrote to memory of 316	1184	Top Urgent_New_Order_PDF.exe	33
PID 1184 wrote to memory of 316	1184	Top Urgent_New_Order_PDF.exe	33
PID 1184 wrote to memory of 316	1184	Top Urgent_New_Order_PDF.exe	33
PID 1184 wrote to memory of 308	1184	Top Urgent_New_Order_PDF.exe	34
PID 1184 wrote to memory of 308	1184	Top Urgent_New_Order_PDF.exe	34
PID 1184 wrote to memory of 308	1184	Top Urgent_New_Order_PDF.exe	34
PID 1184 wrote to memory of 308	1184	Top Urgent_New_Order_PDF.exe	34
PID 1184 wrote to memory of 1776	1184	Top Urgent_New_Order_PDF.exe	35
PID 1184 wrote to memory of 1776	1184	Top Urgent_New_Order_PDF.exe	35
PID 1184 wrote to memory of 1776	1184	Top Urgent_New_Order_PDF.exe	35
PID 1184 wrote to memory of 1776	1184	Top Urgent_New_Order_PDF.exe	35
PID 1184 wrote to memory of 820	1184	Top Urgent_New_Order_PDF.exe	36
PID 1184 wrote to memory of 820	1184	Top Urgent_New_Order_PDF.exe	36
PID 1184 wrote to memory of 820	1184	Top Urgent_New_Order_PDF.exe	36
PID 1184 wrote to memory of 820	1184	Top Urgent_New_Order_PDF.exe	36

C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mPwwUYOq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFE2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
  "{path}"
  2⤵
  PID:300
- C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
  "{path}"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
  "{path}"
  2⤵
  PID:308
- C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
  "{path}"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe
  "{path}"
  2⤵
  PID:820