Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
ORDER _# 6WHQ492788G.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ORDER _# 6WHQ492788G.exe
Resource
win10v2004-20220414-en
General
-
Target
ORDER _# 6WHQ492788G.exe
-
Size
841KB
-
MD5
abc4f95a5cda04a4c1e3c0a1e0a7eb92
-
SHA1
885bc02ac8295c7cb601df9520f63d0c35b11af5
-
SHA256
7204eac3f08e94c2330bb47f7caf2464c9b04863bd4f52b67d4e166171165b90
-
SHA512
1dd983c5b0b183a3526288ccc57837739ff96268117805737796a83c03953129474e1170b31f0e0fe661e483f8e6d86231fee4e1a58cc992de37a28e6f711518
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ORDER _# 6WHQ492788G.exepid process 1788 ORDER _# 6WHQ492788G.exe 1788 ORDER _# 6WHQ492788G.exe 1788 ORDER _# 6WHQ492788G.exe 1788 ORDER _# 6WHQ492788G.exe 1788 ORDER _# 6WHQ492788G.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ORDER _# 6WHQ492788G.exedescription pid process Token: SeDebugPrivilege 1788 ORDER _# 6WHQ492788G.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ORDER _# 6WHQ492788G.exedescription pid process target process PID 1788 wrote to memory of 1200 1788 ORDER _# 6WHQ492788G.exe schtasks.exe PID 1788 wrote to memory of 1200 1788 ORDER _# 6WHQ492788G.exe schtasks.exe PID 1788 wrote to memory of 1200 1788 ORDER _# 6WHQ492788G.exe schtasks.exe PID 1788 wrote to memory of 1200 1788 ORDER _# 6WHQ492788G.exe schtasks.exe PID 1788 wrote to memory of 2024 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2024 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2024 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2024 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2040 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2040 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2040 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2040 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2044 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2044 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2044 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2044 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 1704 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 1704 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 1704 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 1704 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2028 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2028 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2028 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe PID 1788 wrote to memory of 2028 1788 ORDER _# 6WHQ492788G.exe ORDER _# 6WHQ492788G.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QAFjvvyrFrV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97ED.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER _# 6WHQ492788G.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp97ED.tmpFilesize
1KB
MD5b49710589f7daec1dfe91a019a4180a5
SHA185a3de70bfff5da85861cf841ae7c50fcba52104
SHA256d9659faec8ef0e3732fdc7231b2e7dec43d72de144f87b9c3be1ad650d633e37
SHA51273b4e87c6c3db2919573c1bbe25f4d3c081093ee271cc6c9409449f94f5212803531ab8cf5e599c51cfe84732abcc04098694af4c1ab72700f39d2b3849289f8
-
memory/1200-59-0x0000000000000000-mapping.dmp
-
memory/1788-54-0x0000000000390000-0x0000000000468000-memory.dmpFilesize
864KB
-
memory/1788-55-0x0000000004860000-0x00000000048EC000-memory.dmpFilesize
560KB
-
memory/1788-56-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/1788-57-0x00000000048F0000-0x0000000004944000-memory.dmpFilesize
336KB
-
memory/1788-58-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB