Analysis
-
max time kernel
60s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 15:17
Static task
static1
Behavioral task
behavioral1
Sample
Order Drawing and Specification.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Order Drawing and Specification.exe
Resource
win10v20210410
General
-
Target
Order Drawing and Specification.exe
-
Size
860KB
-
MD5
6fc8b05c55483843b5333e0f2ec7c2ef
-
SHA1
1a102a545be73435889342f112ff646818098b8f
-
SHA256
4ea025e80130ce357432c651f5e577ee7be047b8dd6d369448f53cf8414ce69e
-
SHA512
0a9e4c49c4feaa41587a7ede9d42a86f6eb6e5098c032205ab48530fec51959e1d98a5c5ed92604369dd3bf2d17a2a7c723f8cd34a47e03b316ca39db32466c9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Order Drawing and Specification.exepid process 676 Order Drawing and Specification.exe 676 Order Drawing and Specification.exe 676 Order Drawing and Specification.exe 676 Order Drawing and Specification.exe 676 Order Drawing and Specification.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Order Drawing and Specification.exedescription pid process Token: SeDebugPrivilege 676 Order Drawing and Specification.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Order Drawing and Specification.exedescription pid process target process PID 676 wrote to memory of 1456 676 Order Drawing and Specification.exe schtasks.exe PID 676 wrote to memory of 1456 676 Order Drawing and Specification.exe schtasks.exe PID 676 wrote to memory of 1456 676 Order Drawing and Specification.exe schtasks.exe PID 676 wrote to memory of 1456 676 Order Drawing and Specification.exe schtasks.exe PID 676 wrote to memory of 1008 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1008 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1008 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1008 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1576 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1576 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1576 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1576 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1108 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1108 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1108 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1108 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1288 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1288 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1288 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 1288 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 484 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 484 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 484 676 Order Drawing and Specification.exe Order Drawing and Specification.exe PID 676 wrote to memory of 484 676 Order Drawing and Specification.exe Order Drawing and Specification.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dfYIIvFy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F92.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing and Specification.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1F92.tmpMD5
aa4a2a31462e3cf50d140adc0c07a48d
SHA1419ed1dbb09053b494ae4297be0ad49d27ad1993
SHA256fed474602e86491511775f0c6ecb37d8c5c83ae40824e7b4485eae44882b9bea
SHA5128b53b02bc1dd3250de99f5fd073860ec8c324a0f7c4df3edd5cbb1dd70fdcfe72ac69496c4feb07df9199f29c5beb910c5e030ed901159ed4a388f1cc85a5c55
-
memory/676-59-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/676-61-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/676-62-0x0000000000260000-0x000000000027B000-memory.dmpFilesize
108KB
-
memory/676-63-0x0000000004980000-0x00000000049DF000-memory.dmpFilesize
380KB
-
memory/676-64-0x00000000008D0000-0x00000000008F4000-memory.dmpFilesize
144KB
-
memory/1456-65-0x0000000000000000-mapping.dmp