Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 14:46
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER ENQUIRY#09138.exe
Resource
win7v20210410
General
-
Target
NEW ORDER ENQUIRY#09138.exe
-
Size
1.2MB
-
MD5
8791a2b797c21d7830ea9ac9a8a5a5bd
-
SHA1
64fb146114087b4bcc1fa0ca069bd936bfd81d8e
-
SHA256
20ab52e4380262d3d83ddf0898b715d72d1feca497c566bfb952824cd6c76bc1
-
SHA512
438e530e8481b530318498157627dd594b84e88e689c7409e76fef84175906d62e2d900492beb1f0c94ad8a2d0a4b9ed47e2b93b8a27d2ef74e555cfd7caba51
Malware Config
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1160-62-0x0000000000630000-0x000000000063B000-memory.dmp CustAttr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
NEW ORDER ENQUIRY#09138.exepid process 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe 1160 NEW ORDER ENQUIRY#09138.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEW ORDER ENQUIRY#09138.exedescription pid process Token: SeDebugPrivilege 1160 NEW ORDER ENQUIRY#09138.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEW ORDER ENQUIRY#09138.exedescription pid process target process PID 1160 wrote to memory of 776 1160 NEW ORDER ENQUIRY#09138.exe schtasks.exe PID 1160 wrote to memory of 776 1160 NEW ORDER ENQUIRY#09138.exe schtasks.exe PID 1160 wrote to memory of 776 1160 NEW ORDER ENQUIRY#09138.exe schtasks.exe PID 1160 wrote to memory of 776 1160 NEW ORDER ENQUIRY#09138.exe schtasks.exe PID 1160 wrote to memory of 572 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 572 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 572 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 572 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 836 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 836 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 836 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 836 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1156 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1156 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1156 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1156 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1460 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1460 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1460 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1460 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1452 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1452 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1452 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe PID 1160 wrote to memory of 1452 1160 NEW ORDER ENQUIRY#09138.exe NEW ORDER ENQUIRY#09138.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BzuuSqB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp60E5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY#09138.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp60E5.tmpMD5
bc383956bd114b181f15b1aca8070446
SHA18ff7ce8f817af471f0917218bb611b292716f650
SHA25602d07151a4b4a8d6e61b660f61736ff1c996ed3dd3c3d7e97d18a090b4cf4e94
SHA512d7fd9210623745f75381fa1079d3ff14f0831f19562979f1f4356ebf94eaa04323cc53e88b69602f8506c6da2f28fef5776d6f57ef80a78103c484786cf68334
-
memory/776-65-0x0000000000000000-mapping.dmp
-
memory/1160-59-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1160-61-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/1160-62-0x0000000000630000-0x000000000063B000-memory.dmpFilesize
44KB
-
memory/1160-63-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/1160-64-0x0000000002110000-0x0000000002133000-memory.dmpFilesize
140KB