Analysis
-
max time kernel
106s -
max time network
113s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
13-03-2020 03:32
Static task
static1
Behavioral task
behavioral1
Sample
IRSdeclarationcod.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
IRSdeclarationcod.exe
Resource
win10v200217
General
-
Target
IRSdeclarationcod.exe
-
Size
282KB
-
MD5
fe3fd53ddc7c229b1150d970a05947c0
-
SHA1
3abeddbbbd29310290955cc7c1a895550c92ab96
-
SHA256
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
-
SHA512
8b94e67f48f90d7a0e463a7623ba6f87a5f4108f33587c8f579f29aa3c9b0a22f7e134470824d25dccb552bfc868b18cd3f05ef09aaceef2bab6984c21f203b4
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1868 vssadmin.exe -
Drops file in Program Files directory 7377 IoCs
Processes:
IRSdeclarationcod.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Moscow IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281243.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta IRSdeclarationcod.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48B.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF IRSdeclarationcod.exe File created C:\Program Files\Java\jre7\lib\images\cursors\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL011.XML IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml IRSdeclarationcod.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF IRSdeclarationcod.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9 IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00531_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0197983.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA IRSdeclarationcod.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURE.CFG IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\FUNCRES.XLAM IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\4010F4-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\4010F4-Readme.txt IRSdeclarationcod.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 692 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
IRSdeclarationcod.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1844 IRSdeclarationcod.exe Token: SeImpersonatePrivilege 1844 IRSdeclarationcod.exe Token: SeBackupPrivilege 5768 vssvc.exe Token: SeRestorePrivilege 5768 vssvc.exe Token: SeAuditPrivilege 5768 vssvc.exe Token: SeDebugPrivilege 692 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 17480 IoCs
Processes:
IRSdeclarationcod.exepid process 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe 1844 IRSdeclarationcod.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
IRSdeclarationcod.execmd.exedescription pid process target process PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 1868 1844 IRSdeclarationcod.exe vssadmin.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 216 1844 IRSdeclarationcod.exe notepad.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 1844 wrote to memory of 2924 1844 IRSdeclarationcod.exe cmd.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe PID 2924 wrote to memory of 692 2924 cmd.exe taskkill.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2924 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\4010F4-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\A41B.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 18443⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken