Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
03-12-2021 08:34
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order No. 286353 - Copy.scr
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Purchase Order No. 286353 - Copy.scr
Resource
win10-en-20211014
General
-
Target
Purchase Order No. 286353 - Copy.scr
-
Size
571KB
-
MD5
6e34a3c0b8b6a663a9f236085e450d41
-
SHA1
77b4a1dc260c068a81acc20b3b8e5a968a314055
-
SHA256
5b37a1197dd6866cf0b617735b9f2009cf49dbd065ab46d7a6f36e76d069812b
-
SHA512
2f9422f081bb70658b218e5e2b29c2461f151c962ed7db81c803427abbfe56410e727c0090dda1caf0cc2c5b09ffc76593d8956c930c9d12ff833a40378fda7f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1680 588 WerFault.exe Purchase Order No. 286353 - Copy.scr -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Purchase Order No. 286353 - Copy.scrWerFault.exepowershell.exepid process 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 588 Purchase Order No. 286353 - Copy.scr 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe 484 powershell.exe 588 Purchase Order No. 286353 - Copy.scr -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase Order No. 286353 - Copy.scrWerFault.exepowershell.exedescription pid process Token: SeDebugPrivilege 588 Purchase Order No. 286353 - Copy.scr Token: SeDebugPrivilege 1680 WerFault.exe Token: SeDebugPrivilege 484 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order No. 286353 - Copy.scrdescription pid process target process PID 588 wrote to memory of 484 588 Purchase Order No. 286353 - Copy.scr powershell.exe PID 588 wrote to memory of 484 588 Purchase Order No. 286353 - Copy.scr powershell.exe PID 588 wrote to memory of 484 588 Purchase Order No. 286353 - Copy.scr powershell.exe PID 588 wrote to memory of 484 588 Purchase Order No. 286353 - Copy.scr powershell.exe PID 588 wrote to memory of 800 588 Purchase Order No. 286353 - Copy.scr schtasks.exe PID 588 wrote to memory of 800 588 Purchase Order No. 286353 - Copy.scr schtasks.exe PID 588 wrote to memory of 800 588 Purchase Order No. 286353 - Copy.scr schtasks.exe PID 588 wrote to memory of 800 588 Purchase Order No. 286353 - Copy.scr schtasks.exe PID 588 wrote to memory of 1680 588 Purchase Order No. 286353 - Copy.scr WerFault.exe PID 588 wrote to memory of 1680 588 Purchase Order No. 286353 - Copy.scr WerFault.exe PID 588 wrote to memory of 1680 588 Purchase Order No. 286353 - Copy.scr WerFault.exe PID 588 wrote to memory of 1680 588 Purchase Order No. 286353 - Copy.scr WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order No. 286353 - Copy.scr"C:\Users\Admin\AppData\Local\Temp\Purchase Order No. 286353 - Copy.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UvSdjoXkA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UvSdjoXkA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89E8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 10122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp89E8.tmpMD5
3b021a1d82abda541534b2e48ec1022d
SHA1c4e2c126fc4fddedc908a932f053cdc7e7287bed
SHA256e1cf5d88eb3e7c1224a6f54d3d56ee510d4f18b95727a4a6a4971d8f1cda6c95
SHA5123dfb8b4d29117733c9c197b447021d39f8611fcaca9ab680f12427ddceada860d126c4ba74b7a8a07135799e7c4a07db1ce4d8f585f7b5df55efb449cf6d251e
-
memory/484-61-0x0000000000000000-mapping.dmp
-
memory/484-69-0x0000000002280000-0x0000000002ECA000-memory.dmpFilesize
12.3MB
-
memory/484-68-0x0000000002280000-0x0000000002ECA000-memory.dmpFilesize
12.3MB
-
memory/484-66-0x0000000002280000-0x0000000002ECA000-memory.dmpFilesize
12.3MB
-
memory/588-59-0x00000000004F0000-0x00000000004F8000-memory.dmpFilesize
32KB
-
memory/588-60-0x0000000000B80000-0x0000000000BCC000-memory.dmpFilesize
304KB
-
memory/588-55-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/588-58-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/588-57-0x0000000075731000-0x0000000075733000-memory.dmpFilesize
8KB
-
memory/800-62-0x0000000000000000-mapping.dmp
-
memory/1680-65-0x0000000000000000-mapping.dmp
-
memory/1680-67-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB