Analysis
-
max time kernel
121s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-07-2021 02:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation for named specification new order.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Quotation for named specification new order.exe
Resource
win10v20210410
General
-
Target
Quotation for named specification new order.exe
-
Size
786KB
-
MD5
b8f0f94f760baa38503ac7da4faab222
-
SHA1
2775a004ef8bfdb79ed2fae45066b49d740b1afc
-
SHA256
d3147c430d999a7e8337cfb4120dff3079eef4bf51abc0c979f424eff86f1845
-
SHA512
1c789c724bd67ea1b5a0ee365b8bb40768e87cef7f861f76bdfa9ec7bf99be507d3233b8450722e63378eaa3f841deb94a643925747ad6bb491401b26b5715ec
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Quotation for named specification new order.exepid process 816 Quotation for named specification new order.exe 816 Quotation for named specification new order.exe 816 Quotation for named specification new order.exe 816 Quotation for named specification new order.exe 816 Quotation for named specification new order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quotation for named specification new order.exedescription pid process Token: SeDebugPrivilege 816 Quotation for named specification new order.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Quotation for named specification new order.exedescription pid process target process PID 816 wrote to memory of 1752 816 Quotation for named specification new order.exe schtasks.exe PID 816 wrote to memory of 1752 816 Quotation for named specification new order.exe schtasks.exe PID 816 wrote to memory of 1752 816 Quotation for named specification new order.exe schtasks.exe PID 816 wrote to memory of 1752 816 Quotation for named specification new order.exe schtasks.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1052 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1848 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1296 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe PID 816 wrote to memory of 1744 816 Quotation for named specification new order.exe Quotation for named specification new order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGAkOTDdgeJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3063.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for named specification new order.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3063.tmpMD5
33b5fc0dc0063a793e8cde3009e73453
SHA15575931b2c724df95b367207e66a57b58f4182c4
SHA256d8fe24087518e468b573936cba8bd207b1ff70d9e26b26cd14f9757f261b8106
SHA5124289b025d4d5bcda722d4753d8815265021a374b56e4d89ed8b7526a68b203002b9b00d040ace403aa08b3c4c15dfc2a479c82cf99672c64506e4c5efa47c090
-
memory/816-59-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/816-61-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/816-62-0x00000000003A0000-0x00000000003B0000-memory.dmpFilesize
64KB
-
memory/816-63-0x0000000004D00000-0x0000000004D87000-memory.dmpFilesize
540KB
-
memory/816-64-0x00000000021A0000-0x00000000021E3000-memory.dmpFilesize
268KB
-
memory/1752-65-0x0000000000000000-mapping.dmp