Analysis
-
max time kernel
36s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-07-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
P-Order.scr.exe
Resource
win7v20210410
General
-
Target
P-Order.scr.exe
-
Size
876KB
-
MD5
6cf82e76161361d385c53652fdba1992
-
SHA1
642276d01e7d4c7fc2fa8202025173b8abb3c221
-
SHA256
57d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
-
SHA512
939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
P-Order.scr.exepid process 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe 1072 P-Order.scr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
P-Order.scr.exedescription pid process Token: SeDebugPrivilege 1072 P-Order.scr.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
P-Order.scr.exedescription pid process target process PID 1072 wrote to memory of 1108 1072 P-Order.scr.exe schtasks.exe PID 1072 wrote to memory of 1108 1072 P-Order.scr.exe schtasks.exe PID 1072 wrote to memory of 1108 1072 P-Order.scr.exe schtasks.exe PID 1072 wrote to memory of 1108 1072 P-Order.scr.exe schtasks.exe PID 1072 wrote to memory of 1696 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1696 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1696 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1696 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1500 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1500 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1500 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1500 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1492 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1492 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1492 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1492 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1892 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1892 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1892 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1892 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1740 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1740 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1740 1072 P-Order.scr.exe P-Order.scr.exe PID 1072 wrote to memory of 1740 1072 P-Order.scr.exe P-Order.scr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xEjeDK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp18AF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp18AF.tmpMD5
e04beb166e69d649409cacfdb94b2018
SHA1e49cd00122b1834bcba9497b5d0618925f81de4d
SHA256b565e01c8d9c846d9df44dc19d2261f81fc8462631919748888df7e992cfe662
SHA5127c4fa75a825a3b35229ac93233de3b02c88672ea225202b60943424fcab8b9ad0df47648134fd77fe82ab327658ffb5ea2dc1096dcb8f4ee4ba739704d7ebcb2
-
memory/1072-59-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/1072-61-0x0000000007310000-0x0000000007311000-memory.dmpFilesize
4KB
-
memory/1072-62-0x0000000000350000-0x0000000000352000-memory.dmpFilesize
8KB
-
memory/1072-63-0x000000000A480000-0x000000000A510000-memory.dmpFilesize
576KB
-
memory/1072-64-0x0000000000480000-0x00000000004C3000-memory.dmpFilesize
268KB
-
memory/1108-65-0x0000000000000000-mapping.dmp