c90fdaf1c8ea72c144395f8450b870865dc56f6ea3cef897464cd9e808d01c4a

General

Target
C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
Size 19.4MB
Sample210822-vrr5dspfh2
SHA256 c90fdaf1c8ea72c144395f8450b870865dc56f6ea3cef897464cd9e808d01c4a
MD5 3fce6f41954689d04e221e67abcccef7
SHA1 cb47c54bbd851526ae9223762f0a2e42c2b9f357
SHA512 7a485d17aff86a7f4c34eb5ad9f3452f42d58572bc187ffac8a2b0b9aab504086853886c366fac58e46968a5cfedf84892c7f1c7324f99716262f9fa3fd5b16d
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2608	iphone_data_recovery_pro.exe
3600	iphone_data_recovery_pro.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
File opened for modification	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\Uninstall.exe	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
File created	C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\Uninstall.ini	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	iphone_data_recovery_pro.exe
3600	iphone_data_recovery_pro.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2608	3624	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	76
PID 3624 wrote to memory of 2608	3624	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	76
PID 3624 wrote to memory of 2608	3624	C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe	76
PID 2608 wrote to memory of 3600	2608	iphone_data_recovery_pro.exe	78
PID 2608 wrote to memory of 3600	2608	iphone_data_recovery_pro.exe	78
PID 2608 wrote to memory of 3600	2608	iphone_data_recovery_pro.exe	78

C:\Users\Admin\AppData\Local\Temp\C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe
"C:\Users\Admin\AppData\Local\Temp\C90FDAF1C8EA72C144395F8450B870865DC56F6EA3CEF.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe
  "C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\is-25TBA.tmp\iphone_data_recovery_pro.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-25TBA.tmp\iphone_data_recovery_pro.tmp" /SL5="$301F8,17533879,209408,C:\Program Files (x86)\www.iLike-Share.com\iLike iPhone Data Recovery Pro Setup\iphone_data_recovery_pro.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-121-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3600-122-0x00000000001E0000-0x00000000001E1000-memory.dmp