Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 02:27
Static task
static1
Behavioral task
behavioral1
Sample
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe
Resource
win10v20210408
General
-
Target
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe
-
Size
42KB
-
MD5
3f44809205336c5d5be3a7e6ac0fd1fd
-
SHA1
2551b29711cc8d8799c2ebf30e792bbdb87db804
-
SHA256
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c
-
SHA512
5ea019aee3d1e6f6cec321025874d22a4648848e737ff3fa29dd3d85ff7655a74bae0e9136a60219a2ad65042166c34a04a83fabf616e1f28f8b3efb1cc1c626
Malware Config
Signatures
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\kXQYpOS.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\kXQYpOS.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\kXQYpOS.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\kXQYpOS.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
kXQYpOS.exepid process 2024 kXQYpOS.exe -
Loads dropped DLL 2 IoCs
Processes:
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exepid process 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
kXQYpOS.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe kXQYpOS.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe kXQYpOS.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe kXQYpOS.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE kXQYpOS.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe kXQYpOS.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe kXQYpOS.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe kXQYpOS.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe kXQYpOS.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe kXQYpOS.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe kXQYpOS.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe kXQYpOS.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE kXQYpOS.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe kXQYpOS.exe File opened for modification C:\Program Files\7-Zip\7z.exe kXQYpOS.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe kXQYpOS.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe kXQYpOS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exekXQYpOS.exedescription pid process target process PID 1104 wrote to memory of 2024 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe kXQYpOS.exe PID 1104 wrote to memory of 2024 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe kXQYpOS.exe PID 1104 wrote to memory of 2024 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe kXQYpOS.exe PID 1104 wrote to memory of 2024 1104 8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe kXQYpOS.exe PID 2024 wrote to memory of 1096 2024 kXQYpOS.exe cmd.exe PID 2024 wrote to memory of 1096 2024 kXQYpOS.exe cmd.exe PID 2024 wrote to memory of 1096 2024 kXQYpOS.exe cmd.exe PID 2024 wrote to memory of 1096 2024 kXQYpOS.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe"C:\Users\Admin\AppData\Local\Temp\8439722c38e4446745c3288aefa102d2747a733d0da61e913f888e0624f1e86c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kXQYpOS.exeC:\Users\Admin\AppData\Local\Temp\kXQYpOS.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\150d7de9.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\150d7de9.batMD5
9b32e6947d72cd0ac21c94040dedec0e
SHA158cb64be30aa77719094ff93d94c85b00412f279
SHA2568155ca4f0e46453d4f0e37801e5adeaf1058d1ccd882870bd29ac84d037afc3a
SHA512c5c7575c05c0d910dbb331f9eddaa58b26308735589d9fc1ffe369ddbff14e5665c45b2f540ba4ca08e24a3de6c2436198f7782b4ff5dd513fd2e817fc66c101
-
C:\Users\Admin\AppData\Local\Temp\kXQYpOS.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\kXQYpOS.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\kXQYpOS.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\kXQYpOS.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/1096-69-0x0000000000000000-mapping.dmp
-
memory/1104-60-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB
-
memory/1104-67-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1104-68-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2024-63-0x0000000000000000-mapping.dmp