5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd

General

Target

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe
Size

92KB
MD5

2cf1277a5b8a439d5adbafa86e684c7c
SHA1

89d97f8714e79bd2fbe861523d3a177f278cc994
SHA256

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd
SHA512

9709bac0d7e19c2da443d4d64c5e584e33fe0ee138293776295df4c4eb4682bea48d61c47b0abda12888ad68422be88fec976139db189020c29d978c0e3724df

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

XkBfhV.exe

pid process

4780 XkBfhV.exe

pid	process
4780	XkBfhV.exe

Drops file in Program Files directory 64 IoCs

Processes:

XkBfhV.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	XkBfhV.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe	XkBfhV.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	XkBfhV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exeXkBfhV.exe

description	pid	process	target process
PID 4436 wrote to memory of 4780	4436	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 4436 wrote to memory of 4780	4436	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 4436 wrote to memory of 4780	4436	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 4780 wrote to memory of 2156	4780	XkBfhV.exe	cmd.exe
PID 4780 wrote to memory of 2156	4780	XkBfhV.exe	cmd.exe
PID 4780 wrote to memory of 2156	4780	XkBfhV.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe
"C:\Users\Admin\AppData\Local\Temp\5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6dfc78d1.bat" "
3⤵
PID:2156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6dfc78d1.bat
MD5
56e04e72eca7ca2a590c495bddba209f

SHA1
9bd348794fe9644cde0cde3e8cac48fea78e642c

SHA256
895cea50b88ab5b41b103a9772ff30b50274b28c58d5402a62d85d2d371d5192

SHA512
a4a7016417e314063c32a6dcc490e2b0403db3721f97db1dc669e383056ec21f3219d3015539c76447ad7db9587b2418df8aec764d88cfebe0f34f6e67d1bf1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/2156-117-0x0000000000000000-mapping.dmp

Download
memory/4780-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads