c90fdaf1c8ea72c144395f8450b870865dc56f6ea3cef897464cd9e808d01c4a

General

Target
C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
Size 19.4MB
Sample210822-vrr5dspfh2
SHA256 c90fdaf1c8ea72c144395f8450b870865dc56f6ea3cef897464cd9e808d01c4a
MD5 3fce6f41954689d04e221e67abcccef7
SHA1 cb47c54bbd851526ae9223762f0a2e42c2b9f357
SHA512 7a485d17aff86a7f4c34eb5ad9f3452f42d58572bc187ffac8a2b0b9aab504086853886c366fac58e46968a5cfedf84892c7f1c7324f99716262f9fa3fd5b16d
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1432	iphone_data_recovery_pro.exe
1996	iphone_data_recovery_pro.tmp

Loads dropped DLL 7 IoCs

pid	Process
1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
1432	iphone_data_recovery_pro.exe
1996	iphone_data_recovery_pro.tmp
1996	iphone_data_recovery_pro.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
File opened for modification	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\Uninstall.exe	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
File created	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\Uninstall.ini	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1996	iphone_data_recovery_pro.tmp

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1860 wrote to memory of 1432	1860	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	26
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27
PID 1432 wrote to memory of 1996	1432	iphone_data_recovery_pro.exe	27

C:\Users\Admin\AppData\Local\Temp\C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
"C:\Users\Admin\AppData\Local\Temp\C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe
  "C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\is-GCBV8.tmp\iphone_data_recovery_pro.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GCBV8.tmp\iphone_data_recovery_pro.tmp" /SL5="$101AE,17533879,209408,C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-74-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1860-60-0x0000000076A81000-0x0000000076A83000-memory.dmp

Download

memory/1996-77-0x0000000000250000-0x0000000000251000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads