Analysis
-
max time kernel
122s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
order 2020.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
order 2020.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
order 2020.pdf.exe
-
Size
859KB
-
MD5
fb20c05f12476e883d941268d6ff7ff8
-
SHA1
0c32494e1b87f373392ae969b756947337771d0c
-
SHA256
ce41031b56cdb4cf97a4c9e24b14ffd16672719457b5a394daa7a4ccb91591bf
-
SHA512
640dfae0b0b20c785c556b5522ca66c6efd55c2f54d5d5d552ef1d85d15e38c0fabeca2796d34f1c8778ae456778a1802932bdc4c1ac7fca38147d028d69cd92
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
order 2020.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation order 2020.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
order 2020.pdf.exedescription pid process target process PID 3996 set thread context of 868 3996 order 2020.pdf.exe order 2020.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
order 2020.pdf.exepowershell.exepid process 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 3996 order 2020.pdf.exe 5008 powershell.exe 5008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
order 2020.pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 3996 order 2020.pdf.exe Token: SeDebugPrivilege 5008 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
order 2020.pdf.exeorder 2020.pdf.execmd.exedescription pid process target process PID 3996 wrote to memory of 220 3996 order 2020.pdf.exe schtasks.exe PID 3996 wrote to memory of 220 3996 order 2020.pdf.exe schtasks.exe PID 3996 wrote to memory of 220 3996 order 2020.pdf.exe schtasks.exe PID 3996 wrote to memory of 3924 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 3924 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 3924 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 4508 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 4508 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 4508 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 3996 wrote to memory of 868 3996 order 2020.pdf.exe order 2020.pdf.exe PID 868 wrote to memory of 1152 868 order 2020.pdf.exe cmd.exe PID 868 wrote to memory of 1152 868 order 2020.pdf.exe cmd.exe PID 868 wrote to memory of 1152 868 order 2020.pdf.exe cmd.exe PID 1152 wrote to memory of 5008 1152 cmd.exe powershell.exe PID 1152 wrote to memory of 5008 1152 cmd.exe powershell.exe PID 1152 wrote to memory of 5008 1152 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe"C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSRQyICPZwKer" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\order 2020.pdf.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order 2020.pdf.exe.logFilesize
412B
MD5ad1c7f6525cfeb54c0487efd38b0e26c
SHA1ed3da94723ac7e3828a9e93d68418bb810592f3b
SHA2560a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276
SHA51248d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c
-
C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmpFilesize
1KB
MD59102c19eefd948a84ed181429bfae74f
SHA17f9aa98c8fdd29141ab8241038b4d3a8005b631f
SHA256e24e1885e275c4bbecff6dacfd5e1cbb23a8775f1c3634645e07a2d7f061b089
SHA512570583637114680a097d1ba8de91afe37d4edaa6f5e9c360ed9c7f14ac1b542ee2ceac57488ff8726f71b28fe9d4a666105dfe24f6d91a1357a69944dff5db0b
-
memory/220-133-0x0000000000000000-mapping.dmp
-
memory/868-138-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/868-141-0x0000000005520000-0x0000000005586000-memory.dmpFilesize
408KB
-
memory/868-140-0x00000000059E0000-0x0000000005F84000-memory.dmpFilesize
5.6MB
-
memory/868-137-0x0000000000000000-mapping.dmp
-
memory/1152-142-0x0000000000000000-mapping.dmp
-
memory/3924-135-0x0000000000000000-mapping.dmp
-
memory/3996-130-0x0000000000D20000-0x0000000000DFE000-memory.dmpFilesize
888KB
-
memory/3996-132-0x0000000005C30000-0x0000000005CC2000-memory.dmpFilesize
584KB
-
memory/3996-131-0x0000000005AF0000-0x0000000005B8C000-memory.dmpFilesize
624KB
-
memory/4508-136-0x0000000000000000-mapping.dmp
-
memory/5008-145-0x0000000005000000-0x0000000005628000-memory.dmpFilesize
6.2MB
-
memory/5008-144-0x00000000022F0000-0x0000000002326000-memory.dmpFilesize
216KB
-
memory/5008-143-0x0000000000000000-mapping.dmp
-
memory/5008-146-0x0000000004C60000-0x0000000004C82000-memory.dmpFilesize
136KB
-
memory/5008-147-0x0000000004D00000-0x0000000004D66000-memory.dmpFilesize
408KB
-
memory/5008-148-0x0000000005C80000-0x0000000005C9E000-memory.dmpFilesize
120KB
-
memory/5008-149-0x0000000007380000-0x00000000079FA000-memory.dmpFilesize
6.5MB
-
memory/5008-150-0x00000000061B0000-0x00000000061CA000-memory.dmpFilesize
104KB
-
memory/5008-151-0x0000000006F00000-0x0000000006F96000-memory.dmpFilesize
600KB
-
memory/5008-152-0x0000000006280000-0x00000000062A2000-memory.dmpFilesize
136KB