9d83580b805924c53fcb6e150a8c711b9a8169718883eadbc81aa2b0e6fd3b99

General

Target

FIRST PURCHASE ORDER.exe
Size

714KB
MD5

dbbac19cfd01ab4e759500a13168a30b
SHA1

71917c8765aaa6e2869cc1b949bfddf3580457c5
SHA256

fe41fe0b302887f61f20473015f386ab57ddb4cc278b3e1639c07337012a58f4
SHA512

caa08b928acff84a762f64c8c18c332db8f546d003085415560bdc265c3c90953d3e54da5e2031d188beca49e8c891966f8f8de66c8202928045acfd7d80d4ee

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FIRST PURCHASE ORDER.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	FIRST PURCHASE ORDER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3148 schtasks.exe

pid	process
3148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

FIRST PURCHASE ORDER.exe

pid	process
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe
3216	FIRST PURCHASE ORDER.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FIRST PURCHASE ORDER.exe

description pid process

Token: SeDebugPrivilege 3216 FIRST PURCHASE ORDER.exe

description	pid	process
Token: SeDebugPrivilege	3216	FIRST PURCHASE ORDER.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

FIRST PURCHASE ORDER.exe

description	pid	process	target process
PID 3216 wrote to memory of 3148	3216	FIRST PURCHASE ORDER.exe	schtasks.exe
PID 3216 wrote to memory of 3148	3216	FIRST PURCHASE ORDER.exe	schtasks.exe
PID 3216 wrote to memory of 3148	3216	FIRST PURCHASE ORDER.exe	schtasks.exe
PID 3216 wrote to memory of 316	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 316	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 316	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 176	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 176	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 176	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 204	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 204	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 204	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 212	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 212	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 212	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 4020	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 4020	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe
PID 3216 wrote to memory of 4020	3216	FIRST PURCHASE ORDER.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\FIRST PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\FIRST PURCHASE ORDER.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EOFicAFbFaB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDA0.tmp"
2⤵
- Creates scheduled task(s)
PID:3148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:4020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCDA0.tmp
Filesize
1KB

MD5
4de0bd61d977a1861de83a9cbd234d24

SHA1
7dac22ec3c496b0c7556ac21123034bef0aa998b

SHA256
504f8664c8262c9dd9775422792fc743c88acce1c26d1f8a7d9cba87aeac24f5

SHA512
fa6ecaf0f0e6c055ac8ae6f12e2e653c54894de1c07336c191251f47bc774b837db865fa3778feb21a032817fc4dae452bff67bc781dcb25c60220025e620f45

Download Submit
memory/176-137-0x0000000000000000-mapping.dmp

Download
memory/204-138-0x0000000000000000-mapping.dmp

Download
memory/212-139-0x0000000000000000-mapping.dmp

Download
memory/316-136-0x0000000000000000-mapping.dmp

Download
memory/3148-134-0x0000000000000000-mapping.dmp

Download
memory/3216-130-0x0000000000230000-0x00000000002E8000-memory.dmp

Filesize
736KB

Download
memory/3216-131-0x0000000005290000-0x0000000005834000-memory.dmp

Filesize
5.6MB

Download
memory/3216-132-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/3216-133-0x0000000004E20000-0x0000000004EBC000-memory.dmp

Filesize
624KB

Download
memory/4020-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads