Analysis
- max time kernel
114s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
31/10/2021, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
d69f556eb6cc53d985a2f9cb85c33bc9.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d69f556eb6cc53d985a2f9cb85c33bc9.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target d69f556eb6cc53d985a2f9cb85c33bc9.exe
- Size 1.5MB
- Sample211031-jpt3nscedj
- SHA256 cc3456df5b06b6f2cae266ee1be8efdfa9396fa97a4b54a68b64ed839989de56
- MD5 d69f556eb6cc53d985a2f9cb85c33bc9
- SHA1 dbc0a435c770363f4f00bdfeeaef9719d8aa5788
- SHA512 c3ac6495dd8f9bdb2a0c0a589c32ef5e5ea4031e837a9291e4595ac4a75c29b9ec128e5831ae996eccd3a0a84a6978f4f5414a1621c3cfa9ef21b3f45c86486f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000600000001ab89-117.dat aspack_v212_v242 behavioral2/files/0x000600000001ab89-116.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2664 tbPLVy.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\spotiify = "C:\\Users\\Admin\\AppData\\Local\\spotiify\\spotiify.exe\ue600" d69f556eb6cc53d985a2f9cb85c33bc9.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\spotiify = "C:\\Users\\Admin\\AppData\\Local\\spotiify\\spotiify.exe" d69f556eb6cc53d985a2f9cb85c33bc9.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe tbPLVy.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe tbPLVy.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe tbPLVy.exe File opened for modification C:\Program Files\7-Zip\7zG.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE tbPLVy.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe tbPLVy.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe tbPLVy.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE tbPLVy.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE tbPLVy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe tbPLVy.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe tbPLVy.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe tbPLVy.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe tbPLVy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe tbPLVy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe tbPLVy.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{968C015A-D925-42EC-AE27-77BF1D6BB462}\chrome_installer.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe tbPLVy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe tbPLVy.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: RenamesItself 3 IoCs
pid Process 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2664 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 68 PID 2488 wrote to memory of 2664 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 68 PID 2488 wrote to memory of 2664 2488 d69f556eb6cc53d985a2f9cb85c33bc9.exe 68 PID 2664 wrote to memory of 2660 2664 tbPLVy.exe 69 PID 2664 wrote to memory of 2660 2664 tbPLVy.exe 69 PID 2664 wrote to memory of 2660 2664 tbPLVy.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69f556eb6cc53d985a2f9cb85c33bc9.exe"C:\Users\Admin\AppData\Local\Temp\d69f556eb6cc53d985a2f9cb85c33bc9.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\tbPLVy.exeC:\Users\Admin\AppData\Local\Temp\tbPLVy.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\39234922.bat" "3⤵PID:2660
-
-