107ff183d6828547a6f3e42d34a5bc32c139adfdde541e1f0a7b64f353116efa

General

Target

询价到订单 Inquiry-to-Order-001030723 xlsx.exe
Size

870KB
MD5

9fd94ce43208dfc9fdaf3bb368c33253
SHA1

8a1ec00ccba5ae7faf81c09a97962af91818d85f
SHA256

107ff183d6828547a6f3e42d34a5bc32c139adfdde541e1f0a7b64f353116efa
SHA512

eabab2707d670ed68ca60e473dbc7083e4026df9c5baa5d44488e273d36c7caeddb381c1096eecd5e6b536fd37577529c2758086e78d019536f3a4a1ddfc2d94
SSDEEP

12288:YULXctnQM61q/xhseWukm8ct+EyQC1q/7NYkbJNKHjHvKy4SCJwh:YUTgmI/+ubDHm1e7uQcKRO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	询价到订单 Inquiry-to-Order-001030723 xlsx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	1136	WerFault.exe	83

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1872	powershell.exe
2512	powershell.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
1872	powershell.exe
2512	powershell.exe
1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2512	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	98
PID 1136 wrote to memory of 2512	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	98
PID 1136 wrote to memory of 2512	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	98
PID 1136 wrote to memory of 1872	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	100
PID 1136 wrote to memory of 1872	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	100
PID 1136 wrote to memory of 1872	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	100
PID 1136 wrote to memory of 5104	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	102
PID 1136 wrote to memory of 5104	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	102
PID 1136 wrote to memory of 5104	1136	询价到订单 Inquiry-to-Order-001030723 xlsx.exe	102

C:\Users\Admin\AppData\Local\Temp\询价到订单 Inquiry-to-Order-001030723 xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\询价到订单 Inquiry-to-Order-001030723 xlsx.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\询价到订单 Inquiry-to-Order-001030723 xlsx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fregOCxCGET.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fregOCxCGET" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FF7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:5104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 1724
  2⤵
  - Program crash
  PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1136 -ip 1136
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ef5bbe41d82eb8393b4a49c42ddba5cb

SHA1
2bc054d4de44b4e1619d2feeb3f2df5644e646ad

SHA256
e39436a224c6a0012f65204700195a02d80cf30df1bc0221354e8866b77d8ad7

SHA512
9e3752101ebdb79017fd65d2db56d201fa4df49b585f345fdbbfbb6208025c870896707395bedcb3e8e66a8340fc0eef3f16d8fd9240137391a44485fb3a81bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wj04bfb.l1p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3FF7.tmp

Filesize
1KB

MD5
f80f2ffa0d1b1db799e8e92be1f378c6

SHA1
29f79436087bbbf3aab4c2d26e5e60a1bf5bd649

SHA256
839dc85ef06c3b9fcfa5ef2e8ea97f109b09a4dc13907e53bae9bf41de0e3bd0

SHA512
d1d805f92fea23f268bec238c59bfc54871eed2e978807ce16f99a1eca43efc8f49cc473105f020bf8b9991e0babafc8173d49dac0a7d6b5b5a9c17bdc03d1fe

Download Submit
memory/1136-134-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/1136-135-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/1136-136-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/1136-137-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/1136-138-0x0000000006450000-0x00000000064EC000-memory.dmp

Filesize
624KB

Download
memory/1136-133-0x00000000009D0000-0x0000000000AAE000-memory.dmp

Filesize
888KB

Download
memory/1872-170-0x0000000006300000-0x000000000631E000-memory.dmp

Filesize
120KB

Download
memory/1872-198-0x0000000007610000-0x000000000762A000-memory.dmp

Filesize
104KB

Download
memory/1872-155-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Filesize
408KB

Download
memory/1872-144-0x00000000053E0000-0x0000000005A08000-memory.dmp

Filesize
6.2MB

Download
memory/1872-149-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/1872-160-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/1872-146-0x0000000005350000-0x0000000005372000-memory.dmp

Filesize
136KB

Download
memory/1872-203-0x0000000007930000-0x0000000007938000-memory.dmp

Filesize
32KB

Download
memory/1872-172-0x000000006D2A0000-0x000000006D2EC000-memory.dmp

Filesize
304KB

Download
memory/1872-200-0x0000000007890000-0x0000000007926000-memory.dmp

Filesize
600KB

Download
memory/1872-196-0x000000007FB80000-0x000000007FB90000-memory.dmp

Filesize
64KB

Download
memory/1872-195-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/2512-194-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2512-193-0x000000007EEC0000-0x000000007EED0000-memory.dmp

Filesize
64KB

Download
memory/2512-183-0x0000000006310000-0x000000000632E000-memory.dmp

Filesize
120KB

Download
memory/2512-197-0x00000000076F0000-0x0000000007D6A000-memory.dmp

Filesize
6.5MB

Download
memory/2512-148-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2512-199-0x00000000070F0000-0x00000000070FA000-memory.dmp

Filesize
40KB

Download
memory/2512-173-0x000000006D2A0000-0x000000006D2EC000-memory.dmp

Filesize
304KB

Download
memory/2512-201-0x00000000072B0000-0x00000000072BE000-memory.dmp

Filesize
56KB

Download
memory/2512-202-0x00000000073C0000-0x00000000073DA000-memory.dmp

Filesize
104KB

Download
memory/2512-171-0x0000000006330000-0x0000000006362000-memory.dmp

Filesize
200KB

Download
memory/2512-147-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2512-143-0x0000000002470000-0x00000000024A6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads