Analysis
-
max time kernel
23s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 01:43
Static task
static1
Behavioral task
behavioral1
Sample
fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe
Resource
win10v20210408
General
-
Target
fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe
-
Size
123KB
-
MD5
17ecc03660333b453b7cd0fe2886089c
-
SHA1
01c9d8f4c9e28bd8c33b0a89f614f690f4c07dcf
-
SHA256
fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154
-
SHA512
ff4fa12d75672baa3b63305f386ef17bef680a98591b40eeff58da2082cbdd55ae8763b7d1c9ea975061570adaa20cae0ab4357e5482eb7eb55e1fac54b2b184
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IoZHGq.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\IoZHGq.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
IoZHGq.exepid process 1876 IoZHGq.exe -
Drops file in Program Files directory 64 IoCs
Processes:
IoZHGq.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe IoZHGq.exe File opened for modification C:\Program Files\7-Zip\7zG.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe IoZHGq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe IoZHGq.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe IoZHGq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe IoZHGq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe IoZHGq.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe IoZHGq.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe IoZHGq.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe IoZHGq.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe IoZHGq.exe File opened for modification C:\Program Files\Windows Mail\wab.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\89.0.4389.114_chrome_installer.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe IoZHGq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe IoZHGq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe IoZHGq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe IoZHGq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe IoZHGq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe IoZHGq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exeIoZHGq.exedescription pid process target process PID 3920 wrote to memory of 1876 3920 fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe IoZHGq.exe PID 3920 wrote to memory of 1876 3920 fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe IoZHGq.exe PID 3920 wrote to memory of 1876 3920 fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe IoZHGq.exe PID 1876 wrote to memory of 188 1876 IoZHGq.exe cmd.exe PID 1876 wrote to memory of 188 1876 IoZHGq.exe cmd.exe PID 1876 wrote to memory of 188 1876 IoZHGq.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe"C:\Users\Admin\AppData\Local\Temp\fc1c4f173d0a2f217744a5b0f6419a02a9fd5ac364332e6ef463ac6edb91d154.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IoZHGq.exeC:\Users\Admin\AppData\Local\Temp\IoZHGq.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\380b05b9.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\380b05b9.batMD5
6226f37127cd81ea0d12bf77d3b92fe3
SHA16706f4ccf0e93f3daea8e830573ecc4e2145b9cc
SHA256e1d6aa4b3e442e92fbc34ba61c6248f23799e337e1f855fca2bad4a78d1e0873
SHA512181d3eedc63a957bee9778b421e8978175c8adfebd5fb05142dcbbe7c11d4f71363404b3aadee2f7471a4604c7690581a79cd5d1caacc069cfc1e19834937b37
-
C:\Users\Admin\AppData\Local\Temp\IoZHGq.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\IoZHGq.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/188-117-0x0000000000000000-mapping.dmp
-
memory/1876-114-0x0000000000000000-mapping.dmp