2f356283c209400c6385a24450f266b59477e035e9389c8d1af4843cd1ad2374

Analysis

max time kernel
168s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 09:18

Target

ORDER (6256 OS)#391 PI.exe
Size

853KB
MD5

19081ef2a08f678a3203b29124043c41
SHA1

e86acea06a600f170402a0c1020c25ac2550ffa0
SHA256

2f356283c209400c6385a24450f266b59477e035e9389c8d1af4843cd1ad2374
SHA512

aad284ae800f26f6d27a12ec66cd42c781861de7fbd907b8c5b3938dc8fa343286b35e21a56c3680cc92e36d1857fb8f1fd53796f3a82be182245493855ffa3f
SSDEEP

24576:F2ibxF1RKDbH8emeHmXlO3Qe5/uwg5+RAj:/xFqXHXmeOlO3QW/2e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1016 schtasks.exe

pid	process
1016	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ORDER (6256 OS)#391 PI.exe

description	pid	process	target process
PID 1000 wrote to memory of 1016	1000	ORDER (6256 OS)#391 PI.exe	schtasks.exe
PID 1000 wrote to memory of 1016	1000	ORDER (6256 OS)#391 PI.exe	schtasks.exe
PID 1000 wrote to memory of 1016	1000	ORDER (6256 OS)#391 PI.exe	schtasks.exe
PID 1000 wrote to memory of 1016	1000	ORDER (6256 OS)#391 PI.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ORDER (6256 OS)#391 PI.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER (6256 OS)#391 PI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BFD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1016

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\tmp6BFD.tmp

Filesize
1KB

MD5
a2bf967a004498622ce8809d86bbeb7a

SHA1
49c866fd491650892a395fa7652f3db442425f0e

SHA256
2d65e28c031357ae888059113a85651ae3cc56d3e31c83ddc55535e0e6490c57

SHA512
c805d742426ad842380517bfd13fe1bf917c020964419f885142de9333fdf065e063518a942fffbfaeb29544d5f1d1c4ed760ef0ab5c09eaa25db1ed238edab3

Download Submit
memory/1000-54-0x0000000000020000-0x00000000000FC000-memory.dmp

Filesize
880KB

Download
memory/1000-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1000-56-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/1000-57-0x0000000005A40000-0x0000000005AD6000-memory.dmp

Filesize
600KB

Download
memory/1000-58-0x0000000004B30000-0x0000000004B7E000-memory.dmp

Filesize
312KB

Download
memory/1016-59-0x0000000000000000-mapping.dmp

Download