18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

General

Target

ioxyfx.dat.exe
Size

7.1MB
MD5

d5f9fa1a8dca5319432f51a5891f7794
SHA1

2a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA256

18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA512

87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

Score

8^/10

persistence spyware ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ioxyfx.dat.exe

pid process

1700 ioxyfx.dat.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ioxyfx.dat.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\SuspendPush.png.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\RedoInvoke.crw.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\ReceiveWatch.png.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\ResetGroup.crw.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\OpenUnprotect.raw.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\DismountSet.png.zhen	ioxyfx.dat.exe
File created	C:\Users\Admin\Pictures\CheckpointCompare.crw.zhen	ioxyfx.dat.exe

Loads dropped DLL 3 IoCs

Processes:

ioxyfx.dat.exeioxyfx.dat.exe

pid process

1424 ioxyfx.dat.exe
1424 ioxyfx.dat.exe
1700 ioxyfx.dat.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1424	ioxyfx.dat.exe
1424	ioxyfx.dat.exe
1700	ioxyfx.dat.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 3924 IoCs

Processes:

ioxyfx.dat.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen.css.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml.zhen	ioxyfx.dat.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.zhen	ioxyfx.dat.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT	ioxyfx.dat.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.config	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm	ioxyfx.dat.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS.zhen	ioxyfx.dat.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html.zhen	ioxyfx.dat.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\11.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\SketchPadTestSchema.xml	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png	ioxyfx.dat.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN105.XML.zhen	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml.zhen	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	ioxyfx.dat.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml	ioxyfx.dat.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.zhen	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECREC.CFG.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\OrielReport.Dotx	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400001.PNG	ioxyfx.dat.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	ioxyfx.dat.exe
File created	C:\Program Files\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx.zhen	ioxyfx.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\FORMS\1033\REPORT.CFG	ioxyfx.dat.exe

Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1136 taskkill.exe
932 taskkill.exe
1188 taskkill.exe
204 taskkill.exe
212 taskkill.exe
236 taskkill.exe
944 taskkill.exe

pid	process
1136	taskkill.exe
932	taskkill.exe
1188	taskkill.exe
204	taskkill.exe
212	taskkill.exe
236	taskkill.exe
944	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ioxyfx.dat.exe

pid	process
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe
1700	ioxyfx.dat.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

vssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeBackupPrivilege	1660	vssvc.exe
Token: SeRestorePrivilege	1660	vssvc.exe
Token: SeAuditPrivilege	1660	vssvc.exe
Token: SeDebugPrivilege	204	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	212	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	236	taskkill.exe
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ioxyfx.dat.exeioxyfx.dat.exe

pid process

1424 ioxyfx.dat.exe
1700 ioxyfx.dat.exe

pid	process
1424	ioxyfx.dat.exe
1700	ioxyfx.dat.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

ioxyfx.dat.exeioxyfx.dat.exe

description	pid	process	target process
PID 1424 wrote to memory of 1700	1424	ioxyfx.dat.exe	ioxyfx.dat.exe
PID 1424 wrote to memory of 1700	1424	ioxyfx.dat.exe	ioxyfx.dat.exe
PID 1424 wrote to memory of 1700	1424	ioxyfx.dat.exe	ioxyfx.dat.exe
PID 1424 wrote to memory of 1700	1424	ioxyfx.dat.exe	ioxyfx.dat.exe
PID 1700 wrote to memory of 204	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 204	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 204	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 204	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 212	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 212	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 212	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 212	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 236	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 236	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 236	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 236	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 944	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 944	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 944	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 944	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1136	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1136	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1136	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1136	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 932	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 932	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 932	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 932	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1188	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1188	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1188	1700	ioxyfx.dat.exe	taskkill.exe
PID 1700 wrote to memory of 1188	1700	ioxyfx.dat.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\ioxyfx.dat.exe
"C:\Users\Admin\AppData\Local\Temp\ioxyfx.dat.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424

C:\ProgramData\ioxyfx.dat.exe
C:\ProgramData\ioxyfx.dat.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM MSExchange*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM Microsoft*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM ora*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM tns*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM mysql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM sql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM postgres*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ioxyfx.dat.exe

Download Submit
C:\ProgramData\ioxyfx.dat.exe

Download Submit
\ProgramData\ioxyfx.dat.exe

Download Submit
\ProgramData\ioxyfx.dat.exe

Download Submit
\ProgramData\ioxyfx.dat.exe

Download Submit
memory/204-10-0x0000000000000000-mapping.dmp

Download
memory/212-11-0x0000000000000000-mapping.dmp

Download
memory/236-12-0x0000000000000000-mapping.dmp

Download
memory/932-15-0x0000000000000000-mapping.dmp

Download
memory/944-13-0x0000000000000000-mapping.dmp

Download
memory/1136-14-0x0000000000000000-mapping.dmp

Download
memory/1188-16-0x0000000000000000-mapping.dmp

Download
memory/1700-4-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads