e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757

General

Target

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe
Size

622KB
MD5

510fd18706accdd42ebcb417ca8e3884
SHA1

81af3d7819030bfba06dd0c2b40a3ccf0f1f3ae0
SHA256

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757
SHA512

d5585f7284120646d2930c5d3748807f1555893eb7d38445eb2ab956ffb745b481716ae311f004ca23ba0e95026e93868d07e1b4d35420fb3d89d4c683b79bfa

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

fKgqa.exe

pid process

4080 fKgqa.exe

pid	process
4080	fKgqa.exe

Drops file in Program Files directory 64 IoCs

Processes:

fKgqa.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	fKgqa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	fKgqa.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	fKgqa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe	fKgqa.exe
File opened for modification	C:\Program Files\Windows Defender\MpUXSrv.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	fKgqa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	fKgqa.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	fKgqa.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{A50F5BA2-C1DE-4223-A03D-AB17178FF778}\89.0.4389.114_chrome_installer.exe	fKgqa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	fKgqa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	fKgqa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	fKgqa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exefKgqa.exe

description	pid	process	target process
PID 852 wrote to memory of 4080	852	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 852 wrote to memory of 4080	852	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 852 wrote to memory of 4080	852	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 4080 wrote to memory of 188	4080	fKgqa.exe	cmd.exe
PID 4080 wrote to memory of 188	4080	fKgqa.exe	cmd.exe
PID 4080 wrote to memory of 188	4080	fKgqa.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe
"C:\Users\Admin\AppData\Local\Temp\e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2b993e92.bat" "
3⤵
PID:188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2b993e92.bat
MD5
616af8285bed652795ca40bc983089a5

SHA1
224b776dabefe4541552cfb5afca698338809bfc

SHA256
5c2424e8c83609f6ddd8e1b2d9e524bf985b56303723bccaf6c04b9861b7aa43

SHA512
6eda64f0339b3ee00e7db32528e824454bf7d382987c67ff76ec47110d96f6dbf19a6607663e090edecfe2acd27fc5fa6d5ad262a146d87b59d06b3a2096f5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/188-117-0x0000000000000000-mapping.dmp

Download
memory/4080-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads