Analysis
-
max time kernel
4294185s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
12-03-2022 14:22
Static task
static1
Behavioral task
behavioral1
Sample
One-Page-Lease-Agreement-Texas.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
One-Page-Lease-Agreement-Texas.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
One-Page-Lease-Agreement-Texas.exe
-
Size
261.0MB
-
MD5
7194384ed0ce511e24b0e119d0d068f6
-
SHA1
9ea9e3f52602988a922e8d8fda000f060be2b248
-
SHA256
7cc35fbce4b353c541f1ee62366248cc072d1c7ce38b1d5ef5db4a2414f26e08
-
SHA512
0faea84e368d301b7b056630b82c9f2a49f01252e66f5699ddf81f879d22fc74e08a810252e87a58cd9e5b147e9c1682678308781d08fd65e2edb2c8017c98d7
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1748 qhjjfwcr.exe -
Loads dropped DLL 6 IoCs
pid Process 1748 qhjjfwcr.exe 1748 qhjjfwcr.exe 1916 MsiExec.exe 1916 MsiExec.exe 1916 MsiExec.exe 1916 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: qhjjfwcr.exe File opened (read-only) \??\J: qhjjfwcr.exe File opened (read-only) \??\Y: qhjjfwcr.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: qhjjfwcr.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: qhjjfwcr.exe File opened (read-only) \??\X: qhjjfwcr.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: qhjjfwcr.exe File opened (read-only) \??\P: qhjjfwcr.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: qhjjfwcr.exe File opened (read-only) \??\K: qhjjfwcr.exe File opened (read-only) \??\U: qhjjfwcr.exe File opened (read-only) \??\V: qhjjfwcr.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: qhjjfwcr.exe File opened (read-only) \??\H: qhjjfwcr.exe File opened (read-only) \??\L: qhjjfwcr.exe File opened (read-only) \??\O: qhjjfwcr.exe File opened (read-only) \??\Q: qhjjfwcr.exe File opened (read-only) \??\R: qhjjfwcr.exe File opened (read-only) \??\S: qhjjfwcr.exe File opened (read-only) \??\Z: qhjjfwcr.exe File opened (read-only) \??\G: qhjjfwcr.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: qhjjfwcr.exe File opened (read-only) \??\N: qhjjfwcr.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: qhjjfwcr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1616 1176 WerFault.exe 28 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1748 qhjjfwcr.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeCreateTokenPrivilege 1748 qhjjfwcr.exe Token: SeAssignPrimaryTokenPrivilege 1748 qhjjfwcr.exe Token: SeLockMemoryPrivilege 1748 qhjjfwcr.exe Token: SeIncreaseQuotaPrivilege 1748 qhjjfwcr.exe Token: SeMachineAccountPrivilege 1748 qhjjfwcr.exe Token: SeTcbPrivilege 1748 qhjjfwcr.exe Token: SeSecurityPrivilege 1748 qhjjfwcr.exe Token: SeTakeOwnershipPrivilege 1748 qhjjfwcr.exe Token: SeLoadDriverPrivilege 1748 qhjjfwcr.exe Token: SeSystemProfilePrivilege 1748 qhjjfwcr.exe Token: SeSystemtimePrivilege 1748 qhjjfwcr.exe Token: SeProfSingleProcessPrivilege 1748 qhjjfwcr.exe Token: SeIncBasePriorityPrivilege 1748 qhjjfwcr.exe Token: SeCreatePagefilePrivilege 1748 qhjjfwcr.exe Token: SeCreatePermanentPrivilege 1748 qhjjfwcr.exe Token: SeBackupPrivilege 1748 qhjjfwcr.exe Token: SeRestorePrivilege 1748 qhjjfwcr.exe Token: SeShutdownPrivilege 1748 qhjjfwcr.exe Token: SeDebugPrivilege 1748 qhjjfwcr.exe Token: SeAuditPrivilege 1748 qhjjfwcr.exe Token: SeSystemEnvironmentPrivilege 1748 qhjjfwcr.exe Token: SeChangeNotifyPrivilege 1748 qhjjfwcr.exe Token: SeRemoteShutdownPrivilege 1748 qhjjfwcr.exe Token: SeUndockPrivilege 1748 qhjjfwcr.exe Token: SeSyncAgentPrivilege 1748 qhjjfwcr.exe Token: SeEnableDelegationPrivilege 1748 qhjjfwcr.exe Token: SeManageVolumePrivilege 1748 qhjjfwcr.exe Token: SeImpersonatePrivilege 1748 qhjjfwcr.exe Token: SeCreateGlobalPrivilege 1748 qhjjfwcr.exe Token: SeRestorePrivilege 432 msiexec.exe Token: SeTakeOwnershipPrivilege 432 msiexec.exe Token: SeSecurityPrivilege 432 msiexec.exe Token: SeCreateTokenPrivilege 1748 qhjjfwcr.exe Token: SeAssignPrimaryTokenPrivilege 1748 qhjjfwcr.exe Token: SeLockMemoryPrivilege 1748 qhjjfwcr.exe Token: SeIncreaseQuotaPrivilege 1748 qhjjfwcr.exe Token: SeMachineAccountPrivilege 1748 qhjjfwcr.exe Token: SeTcbPrivilege 1748 qhjjfwcr.exe Token: SeSecurityPrivilege 1748 qhjjfwcr.exe Token: SeTakeOwnershipPrivilege 1748 qhjjfwcr.exe Token: SeLoadDriverPrivilege 1748 qhjjfwcr.exe Token: SeSystemProfilePrivilege 1748 qhjjfwcr.exe Token: SeSystemtimePrivilege 1748 qhjjfwcr.exe Token: SeProfSingleProcessPrivilege 1748 qhjjfwcr.exe Token: SeIncBasePriorityPrivilege 1748 qhjjfwcr.exe Token: SeCreatePagefilePrivilege 1748 qhjjfwcr.exe Token: SeCreatePermanentPrivilege 1748 qhjjfwcr.exe Token: SeBackupPrivilege 1748 qhjjfwcr.exe Token: SeRestorePrivilege 1748 qhjjfwcr.exe Token: SeShutdownPrivilege 1748 qhjjfwcr.exe Token: SeDebugPrivilege 1748 qhjjfwcr.exe Token: SeAuditPrivilege 1748 qhjjfwcr.exe Token: SeSystemEnvironmentPrivilege 1748 qhjjfwcr.exe Token: SeChangeNotifyPrivilege 1748 qhjjfwcr.exe Token: SeRemoteShutdownPrivilege 1748 qhjjfwcr.exe Token: SeUndockPrivilege 1748 qhjjfwcr.exe Token: SeSyncAgentPrivilege 1748 qhjjfwcr.exe Token: SeEnableDelegationPrivilege 1748 qhjjfwcr.exe Token: SeManageVolumePrivilege 1748 qhjjfwcr.exe Token: SeImpersonatePrivilege 1748 qhjjfwcr.exe Token: SeCreateGlobalPrivilege 1748 qhjjfwcr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 qhjjfwcr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1748 1268 One-Page-Lease-Agreement-Texas.exe 27 PID 1268 wrote to memory of 1176 1268 One-Page-Lease-Agreement-Texas.exe 28 PID 1268 wrote to memory of 1176 1268 One-Page-Lease-Agreement-Texas.exe 28 PID 1268 wrote to memory of 1176 1268 One-Page-Lease-Agreement-Texas.exe 28 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 432 wrote to memory of 1916 432 msiexec.exe 30 PID 1176 wrote to memory of 1616 1176 One-Page-Lease-Agreement-Texas.exe 31 PID 1176 wrote to memory of 1616 1176 One-Page-Lease-Agreement-Texas.exe 31 PID 1176 wrote to memory of 1616 1176 One-Page-Lease-Agreement-Texas.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\One-Page-Lease-Agreement-Texas.exe"C:\Users\Admin\AppData\Local\Temp\One-Page-Lease-Agreement-Texas.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\qhjjfwcr.exe"C:\Users\Admin\AppData\Local\Temp\qhjjfwcr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\One-Page-Lease-Agreement-Texas.exe"C:\Users\Admin\AppData\Local\Temp\One-Page-Lease-Agreement-Texas.exe" /r2⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1176 -s 5923⤵
- Program crash
PID:1616
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89C08C382447DE4EBB0ED41BA4125F2E C2⤵
- Loads dropped DLL
PID:1916
-