Analysis
-
max time kernel
114s -
max time network
115s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
13-03-2020 03:32
Static task
static1
Behavioral task
behavioral1
Sample
IRSdeclarationcod.exe
Resource
win7v200217
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IRSdeclarationcod.exe
Resource
win10v200217
windows10_x64
0 signatures
0 seconds
General
-
Target
IRSdeclarationcod.exe
-
Size
282KB
-
MD5
fe3fd53ddc7c229b1150d970a05947c0
-
SHA1
3abeddbbbd29310290955cc7c1a895550c92ab96
-
SHA256
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
-
SHA512
8b94e67f48f90d7a0e463a7623ba6f87a5f4108f33587c8f579f29aa3c9b0a22f7e134470824d25dccb552bfc868b18cd3f05ef09aaceef2bab6984c21f203b4
Score
9/10
Malware Config
Signatures
-
Drops file in Program Files directory 16976 IoCs
Processes:
IRSdeclarationcod.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\images\en-US\winlogo.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\AppxManifest.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Cert_16.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\ReliveSurfaces\Preview\RelivePreviewControl.xaml IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleAppStoreLogo.scale-200.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48_altform-unplated_contrast-white.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxc IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\THMBNAIL.PNG IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\AppxManifest.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_altform-unplated_contrast-white.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\grmarble.jpg IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square44x44Logo.targetsize-256.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\11c.png IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16_altform-unplated.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7da.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\SmallTile.scale-125.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\12h.png IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-200.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-fullcolor.png IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-visual.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-100.png IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\hyph_en_GB.dic IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-150.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\offsyml.ttf IRSdeclarationcod.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\7-Zip\License.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_11d.png IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\1713C2-Readme.txt IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-80.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG IRSdeclarationcod.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar IRSdeclarationcod.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\1713C2-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ht_16x11.png IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\ProductCascadeJDA27ptsWithLbfLowend.mdl IRSdeclarationcod.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-400.png IRSdeclarationcod.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
IRSdeclarationcod.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4000 IRSdeclarationcod.exe Token: SeImpersonatePrivilege 4000 IRSdeclarationcod.exe Token: SeBackupPrivilege 2916 vssvc.exe Token: SeRestorePrivilege 2916 vssvc.exe Token: SeAuditPrivilege 2916 vssvc.exe Token: SeDebugPrivilege 5752 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 18202 IoCs
Processes:
IRSdeclarationcod.exepid process 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe 4000 IRSdeclarationcod.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
IRSdeclarationcod.execmd.exedescription pid process target process PID 4000 wrote to memory of 4020 4000 IRSdeclarationcod.exe vssadmin.exe PID 4000 wrote to memory of 4020 4000 IRSdeclarationcod.exe vssadmin.exe PID 4000 wrote to memory of 5288 4000 IRSdeclarationcod.exe notepad.exe PID 4000 wrote to memory of 5288 4000 IRSdeclarationcod.exe notepad.exe PID 4000 wrote to memory of 5288 4000 IRSdeclarationcod.exe notepad.exe PID 4000 wrote to memory of 6728 4000 IRSdeclarationcod.exe cmd.exe PID 4000 wrote to memory of 6728 4000 IRSdeclarationcod.exe cmd.exe PID 4000 wrote to memory of 6728 4000 IRSdeclarationcod.exe cmd.exe PID 6728 wrote to memory of 5752 6728 cmd.exe taskkill.exe PID 6728 wrote to memory of 5752 6728 cmd.exe taskkill.exe PID 6728 wrote to memory of 5752 6728 cmd.exe taskkill.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5752 taskkill.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4020 vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\1713C2-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6711.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 40003⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken