IRSdeclarationcod.exe
General
Target
Filesize
Completed
IRSdeclarationcod.exe
282KB
13-03-2020 03:34
Score
9/10
MD5
SHA1
SHA256
fe3fd53ddc7c229b1150d970a05947c0
3abeddbbbd29310290955cc7c1a895550c92ab96
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
Malware Config
Signatures 9
Filter: none
Defense Evasion
Impact
Persistence
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Interacts with shadow copiesvssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 1868 vssadmin.exe -
Drops file in Program Files directoryIRSdeclarationcod.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Moscow IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281243.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta IRSdeclarationcod.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48B.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF IRSdeclarationcod.exe File created C:\Program Files\Java\jre7\lib\images\cursors\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL011.XML IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml IRSdeclarationcod.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF IRSdeclarationcod.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9 IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00531_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0197983.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA IRSdeclarationcod.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURE.CFG IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\FUNCRES.XLAM IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\4010F4-Readme.txt IRSdeclarationcod.exe -
Modifies servicevssvc.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Kills process with taskkilltaskkill.exe
Tags
Reported IOCs
pid process 692 taskkill.exe -
Suspicious use of AdjustPrivilegeTokenIRSdeclarationcod.exevssvc.exetaskkill.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1844 IRSdeclarationcod.exe Token: SeImpersonatePrivilege 1844 IRSdeclarationcod.exe Token: SeBackupPrivilege 5768 vssvc.exe Token: SeRestorePrivilege 5768 vssvc.exe Token: SeAuditPrivilege 5768 vssvc.exe Token: SeDebugPrivilege 692 taskkill.exe -
Suspicious behavior: EnumeratesProcessesIRSdeclarationcod.exe
Reported IOCs
pid process 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe -
Suspicious use of WriteProcessMemoryIRSdeclarationcod.execmd.exe
Reported IOCs
description pid process target process PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe -
Deletes itselfcmd.exe
Reported IOCs
pid process 2924 cmd.exe
Processes 6
-
C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exePID:1844"C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"Drops file in Program Files directorySuspicious use of AdjustPrivilegeTokenSuspicious behavior: EnumeratesProcessesSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exePID:1868C:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\SysWOW64\notepad.exePID:216C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\4010F4-Readme.txt"
-
C:\Windows\SysWOW64\cmd.exePID:2924cmd /c "C:\Users\Admin\AppData\Local\Temp\A41B.tmp.bat"Suspicious use of WriteProcessMemoryDeletes itself
-
C:\Windows\SysWOW64\taskkill.exePID:692taskkill /F /PID 1844Kills process with taskkillSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exePID:5768C:\Windows\system32\vssvc.exeModifies serviceSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A41B.tmp.bat
-
C:\Users\Admin\Desktop\4010F4-Readme.txt
Title
Loading data