Analysis
-
max time kernel
86s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:19
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
INQUIRY.exe
Resource
win10v2004-20220414-en
General
-
Target
INQUIRY.exe
-
Size
755KB
-
MD5
80f173a6a405dcc12a8e3b4b3068c481
-
SHA1
303de8b04f8d274e762b6a7da8fe71e72ff1bdae
-
SHA256
a60d036982b1a91c4ccc905f17da542297129040d3c4c5b6546a7158b2e0dcbe
-
SHA512
2819d68ad38a695898c46ef5f1b4c1c8ca70cc14927acee5339558e3e62b1565a1132769958f36154b268c31a0ba6c9749130137d040f55017a94249237eb195
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
INQUIRY.exepid process 304 INQUIRY.exe 304 INQUIRY.exe 304 INQUIRY.exe 304 INQUIRY.exe 304 INQUIRY.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
INQUIRY.exedescription pid process Token: SeDebugPrivilege 304 INQUIRY.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
INQUIRY.exedescription pid process target process PID 304 wrote to memory of 612 304 INQUIRY.exe schtasks.exe PID 304 wrote to memory of 612 304 INQUIRY.exe schtasks.exe PID 304 wrote to memory of 612 304 INQUIRY.exe schtasks.exe PID 304 wrote to memory of 612 304 INQUIRY.exe schtasks.exe PID 304 wrote to memory of 828 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 828 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 828 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 828 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1412 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1412 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1412 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1412 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1140 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1140 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1140 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1140 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1264 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1264 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1264 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1264 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1224 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1224 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1224 304 INQUIRY.exe INQUIRY.exe PID 304 wrote to memory of 1224 304 INQUIRY.exe INQUIRY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ITneOFLl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA6FA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA6FA.tmpFilesize
1KB
MD559196dfc1b4f9f7fa7ea2aa3ef3530a1
SHA1d0fc1d7b60334016eeaa41bf93fcf83e470d16e4
SHA256e0cc9f36069c8566b3226f5d6bd56884db2fc44ffb8f710006a4778488c2ce52
SHA512e13d1e11a86165d541003e3a8c36be3fc096822ab96157172b0ed856e9db1915c57680a628f22705976c8fc282bd3fd50da79e39b9d63060260e86e50b84b7dd
-
memory/304-54-0x0000000075311000-0x0000000075313000-memory.dmpFilesize
8KB
-
memory/304-55-0x0000000074390000-0x000000007493B000-memory.dmpFilesize
5.7MB
-
memory/612-56-0x0000000000000000-mapping.dmp