2e2f674241de56d4404a8fdbcb470fd9738d48c855fb0785deaae99ea3af383f

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Size 996KB
Sample221212-rwallsec4z
SHA256 2e2f674241de56d4404a8fdbcb470fd9738d48c855fb0785deaae99ea3af383f
MD5 ffec9f3d109cd570f9a2962adc6f14c1
SHA1 6b5045282bfb648754bbd3d40706fde1ee6dd7c3
SHA512 bc1625968ac597a61e06bc9468f3d5b6bc92128920462c187807987475d9c99016712480d85243656cee7696f61fbb2a51f71a4e9772d355910db3b67c1cc3a6
SSDEEP 24576:gszQve9P6I2wgNd3lRZCrHi8LGRDi66pFkf:gszSUwNd1nj8LGBh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3204	systems.exe
2532	systems.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	systems.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systems-AMVXWJ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\systems.exe\""	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	systems.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systems-AMVXWJ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\systems.exe\""	systems.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 3204 set thread context of 2532	3204	systems.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4552	schtasks.exe
4084	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
1688	powershell.exe
1688	powershell.exe
3204	systems.exe
3204	systems.exe
3204	systems.exe
3204	systems.exe
3204	systems.exe
3204	systems.exe
3204	systems.exe
2624	powershell.exe
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	3204	systems.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	systems.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1688	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	101
PID 4804 wrote to memory of 1688	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	101
PID 4804 wrote to memory of 1688	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	101
PID 4804 wrote to memory of 4084	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	103
PID 4804 wrote to memory of 4084	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	103
PID 4804 wrote to memory of 4084	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	103
PID 4804 wrote to memory of 5004	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	105
PID 4804 wrote to memory of 5004	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	105
PID 4804 wrote to memory of 5004	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	105
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 4804 wrote to memory of 5000	4804	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	106
PID 5000 wrote to memory of 3728	5000	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	107
PID 5000 wrote to memory of 3728	5000	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	107
PID 5000 wrote to memory of 3728	5000	REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe	107
PID 3728 wrote to memory of 1448	3728	WScript.exe	108
PID 3728 wrote to memory of 1448	3728	WScript.exe	108
PID 3728 wrote to memory of 1448	3728	WScript.exe	108
PID 1448 wrote to memory of 3204	1448	cmd.exe	110
PID 1448 wrote to memory of 3204	1448	cmd.exe	110
PID 1448 wrote to memory of 3204	1448	cmd.exe	110
PID 3204 wrote to memory of 2624	3204	systems.exe	112
PID 3204 wrote to memory of 2624	3204	systems.exe	112
PID 3204 wrote to memory of 2624	3204	systems.exe	112
PID 3204 wrote to memory of 4552	3204	systems.exe	114
PID 3204 wrote to memory of 4552	3204	systems.exe	114
PID 3204 wrote to memory of 4552	3204	systems.exe	114
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116
PID 3204 wrote to memory of 2532	3204	systems.exe	116

C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kHaNnkEj.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kHaNnkEj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1CEE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
  "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe"
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe
  "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\systems.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\systems.exe
        
        C:\Users\Admin\AppData\Local\Temp\systems.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3204
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kHaNnkEj.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kHaNnkEj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE58D.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\systems.exe
        
        "C:\Users\Admin\AppData\Local\Temp\systems.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 45fcc7e2b6c3bfddc60b4c2ce962c8f0889bd35c309fd16a39451a099269fb28
MD5 9109a3264c3a2826b779f7997c04c314
SHA1 3f03c3721e36bf825e22848f774e0b90d4f122a1
SHA512 06186bbc26281f872f711bd4baaba7c729420ecc5f6ccdd7cfeba034e47a31e8b3842ca210095afcc510344d2c40d22b769eba9641a669c6c45f8a9a7ec9bd1c
SSDEEP 384:Wsf+BC9i+lP6G4oeM8n7CJk9spo2ThK6seYLME/N03SoZyfYSgcjEDkyQ0gdEtk6:zfNM0g739co2ThNgrWSlWCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 412B
SHA256 26a351352da2d7c2113f515f0e06c8455c9a76441715d4c8a7b7fa4d5ac48941
MD5 77bbe6719a215c1b7fb8990b1e677681
SHA1 d5198d5aa3b080b7c85db7618bfc7267a4a34c07
SHA512 31acf7dc97945e9051bae823ffa686570497951f6497051072d9acd2c712416a900c3d6c51c3a5a0a59684dbebf0a6a9fab63e5dd0b0f21a42f3cf04eee070f7
MD5 SHA1 SHA512

Submit Download

systems.exe

Path C:\Users\Admin\AppData\Local\Temp\systems.exe
Size 996KB
SHA256 2e2f674241de56d4404a8fdbcb470fd9738d48c855fb0785deaae99ea3af383f
MD5 ffec9f3d109cd570f9a2962adc6f14c1
SHA1 6b5045282bfb648754bbd3d40706fde1ee6dd7c3
SHA512 bc1625968ac597a61e06bc9468f3d5b6bc92128920462c187807987475d9c99016712480d85243656cee7696f61fbb2a51f71a4e9772d355910db3b67c1cc3a6
SSDEEP 24576:gszQve9P6I2wgNd3lRZCrHi8LGRDi66pFkf:gszSUwNd1nj8LGBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

systems.exe

Path C:\Users\Admin\AppData\Local\Temp\systems.exe
Size 996KB
SHA256 2e2f674241de56d4404a8fdbcb470fd9738d48c855fb0785deaae99ea3af383f
MD5 ffec9f3d109cd570f9a2962adc6f14c1
SHA1 6b5045282bfb648754bbd3d40706fde1ee6dd7c3
SHA512 bc1625968ac597a61e06bc9468f3d5b6bc92128920462c187807987475d9c99016712480d85243656cee7696f61fbb2a51f71a4e9772d355910db3b67c1cc3a6
SSDEEP 24576:gszQve9P6I2wgNd3lRZCrHi8LGRDi66pFkf:gszSUwNd1nj8LGBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

systems.exe

Path C:\Users\Admin\AppData\Local\Temp\systems.exe
Size 996KB
SHA256 2e2f674241de56d4404a8fdbcb470fd9738d48c855fb0785deaae99ea3af383f
MD5 ffec9f3d109cd570f9a2962adc6f14c1
SHA1 6b5045282bfb648754bbd3d40706fde1ee6dd7c3
SHA512 bc1625968ac597a61e06bc9468f3d5b6bc92128920462c187807987475d9c99016712480d85243656cee7696f61fbb2a51f71a4e9772d355910db3b67c1cc3a6
SSDEEP 24576:gszQve9P6I2wgNd3lRZCrHi8LGRDi66pFkf:gszSUwNd1nj8LGBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1CEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1CEE.tmp
Size 1KB
SHA256 2b45eacbc72f9a9fd833ef61e639352e411d9a753cd0e95edfd90fde19e748f0
MD5 8537050474394db410ab9511a9176f15
SHA1 944d4ebec38af58d5bc3d037b29245f1f741dc3b
SHA512 559858bbcfb58179361c3d99222b1faad557dbde2475d9baa236e9bc3915a664966adba3a9ab2cd0d077f19c6098a798f6a200110d50645571c6d5d7f4582af4
MD5 SHA1 SHA512

Submit Download

tmpE58D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE58D.tmp
Size 1KB
SHA256 2b45eacbc72f9a9fd833ef61e639352e411d9a753cd0e95edfd90fde19e748f0
MD5 8537050474394db410ab9511a9176f15
SHA1 944d4ebec38af58d5bc3d037b29245f1f741dc3b
SHA512 559858bbcfb58179361c3d99222b1faad557dbde2475d9baa236e9bc3915a664966adba3a9ab2cd0d077f19c6098a798f6a200110d50645571c6d5d7f4582af4
MD5 SHA1 SHA512

Submit Download

memory/1688-169-0x0000000007CD0000-0x0000000007CD8000-memory.dmp

Download

memory/1688-147-0x00000000056C0000-0x00000000056E2000-memory.dmp

Download

memory/1688-165-0x0000000007A20000-0x0000000007A2A000-memory.dmp

Download

memory/1688-164-0x00000000079B0000-0x00000000079CA000-memory.dmp

Download

memory/1688-141-0x0000000005800000-0x0000000005E28000-memory.dmp

Download

memory/1688-149-0x0000000005760000-0x00000000057C6000-memory.dmp

Download

memory/1688-168-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

Download

memory/1688-150-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/1688-163-0x0000000007FF0000-0x000000000866A000-memory.dmp

Download

memory/1688-162-0x0000000006C40000-0x0000000006C5E000-memory.dmp

Download

memory/1688-139-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Download

memory/1688-161-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/1688-160-0x0000000007650000-0x0000000007682000-memory.dmp

Download

memory/1688-166-0x0000000007C30000-0x0000000007CC6000-memory.dmp

Download

memory/1688-167-0x0000000007BE0000-0x0000000007BEE000-memory.dmp

Download

memory/1688-154-0x00000000066A0000-0x00000000066BE000-memory.dmp

Download

memory/2532-183-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2532-181-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2532-178-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2532-179-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2624-182-0x0000000070B50000-0x0000000070B9C000-memory.dmp

Download

memory/4804-133-0x0000000005330000-0x00000000058D4000-memory.dmp

Download

memory/4804-134-0x0000000004C60000-0x0000000004CF2000-memory.dmp

Download

memory/4804-135-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Download

memory/4804-132-0x0000000000190000-0x0000000000290000-memory.dmp

Download

memory/4804-136-0x00000000087D0000-0x000000000886C000-memory.dmp

Download

memory/5000-148-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5000-144-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5000-146-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5000-151-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5000-153-0x0000000000400000-0x0000000000435000-memory.dmp

Download