Analysis
-
max time kernel
24s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 02:38
Static task
static1
Behavioral task
behavioral1
Sample
5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe
Resource
win10v20210408
General
-
Target
5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe
-
Size
208KB
-
MD5
d5b127a5e33eb708ac8e8aece51d4ac5
-
SHA1
3a80aee844263f34d6151f613cf731bf8675d3be
-
SHA256
5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e
-
SHA512
5c06ae80cb4b1b29f3ea425be30ca4fde5b59b3bc3342bdc356deda5fd147989980ca1fe4a3676fda5dd88c328464edcefc27fc323fae2178d13db90684a0fd1
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\LRSVPJ.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\LRSVPJ.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
LRSVPJ.exepid process 3784 LRSVPJ.exe -
Drops file in Program Files directory 64 IoCs
Processes:
LRSVPJ.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\89.0.4389.114_chrome_installer.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE LRSVPJ.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe LRSVPJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe LRSVPJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe LRSVPJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe LRSVPJ.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe LRSVPJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe LRSVPJ.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe LRSVPJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe LRSVPJ.exe File opened for modification C:\Program Files\7-Zip\7z.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe LRSVPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe LRSVPJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe LRSVPJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE LRSVPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE LRSVPJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exeLRSVPJ.exedescription pid process target process PID 640 wrote to memory of 3784 640 5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe LRSVPJ.exe PID 640 wrote to memory of 3784 640 5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe LRSVPJ.exe PID 640 wrote to memory of 3784 640 5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe LRSVPJ.exe PID 3784 wrote to memory of 188 3784 LRSVPJ.exe cmd.exe PID 3784 wrote to memory of 188 3784 LRSVPJ.exe cmd.exe PID 3784 wrote to memory of 188 3784 LRSVPJ.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe"C:\Users\Admin\AppData\Local\Temp\5e88a5b2618ce9af2e3e66714c6dbe1fd26ba8dc27aacfda6b61ccf423dcb14e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LRSVPJ.exeC:\Users\Admin\AppData\Local\Temp\LRSVPJ.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\01245f94.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\01245f94.batMD5
bffd2e35885b10f40ca68e56134a6ce9
SHA16255ff9387e49b02d42fe05f1e2819d809c91c18
SHA256d6724efbd41f98cbf2ab46650984909c4f9e837432b4426a64a456c6435dd55b
SHA5124ec5ccc66e65e0f9e25a960c724a9b799919940761f7f4870547169daf731f5474b3a8986f60ebb43bb3462039889ee703e4d0b0103cab9e572940508212e2af
-
C:\Users\Admin\AppData\Local\Temp\LRSVPJ.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\LRSVPJ.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/188-117-0x0000000000000000-mapping.dmp
-
memory/3784-114-0x0000000000000000-mapping.dmp