a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303

General

Target

a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe
Size

30KB
MD5

e69594b80bb76a154a74a369565b7d7a
SHA1

08fc28bf217ee65db63327afa5bc897c34bbdfcb
SHA256

a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303
SHA512

5c529427f05ac5d643045379f20adb8286f542627bd92b439bc6864b6210a474aae78726847eea8716843b65b52ad4e4efab39630bc3fb2466180b8baa11eed7

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\iAHeXy.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\iAHeXy.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

iAHeXy.exe

pid process

1492 iAHeXy.exe

pid	process
1492	iAHeXy.exe

Loads dropped DLL 2 IoCs

Processes:

a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe

pid	process
1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe
1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe

Drops file in Program Files directory 64 IoCs

Processes:

iAHeXy.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\misc.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	iAHeXy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	iAHeXy.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	iAHeXy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exeiAHeXy.exe

description	pid	process	target process
PID 1684 wrote to memory of 1492	1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe	iAHeXy.exe
PID 1684 wrote to memory of 1492	1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe	iAHeXy.exe
PID 1684 wrote to memory of 1492	1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe	iAHeXy.exe
PID 1684 wrote to memory of 1492	1684	a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe	iAHeXy.exe
PID 1492 wrote to memory of 828	1492	iAHeXy.exe	cmd.exe
PID 1492 wrote to memory of 828	1492	iAHeXy.exe	cmd.exe
PID 1492 wrote to memory of 828	1492	iAHeXy.exe	cmd.exe
PID 1492 wrote to memory of 828	1492	iAHeXy.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe
"C:\Users\Admin\AppData\Local\Temp\a8b5825ccf3c2a5238d0d11dfdaf853c5b75d3f8dfb6c4c7f81022a9108e4303.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe
C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\6a746b9c.bat" "
3⤵
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6a746b9c.bat
MD5
f4b478a7da6afce64582def2ea032acb

SHA1
4e9764d4acf9f51644ff93beba3c4d2cda76cb5c

SHA256
0c88f08d96c0e795152a0a334ccb193eed51b687bac8ca372c7cd787a8d1e9df

SHA512
77c12abc882dae4a3e101453d8a2ef3436d787034d5b5edb08a2d790aabcad62529ff239e5205dff3f3436f42d4bf9e20242b41d61e817d63079f872e78dc980

Download Submit
C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iAHeXy.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\iAHeXy.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\iAHeXy.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/828-69-0x0000000000000000-mapping.dmp

Download
memory/1492-63-0x0000000000000000-mapping.dmp

Download
memory/1684-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1684-67-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1684-68-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads