Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 09:14
Static task
static1
Behavioral task
behavioral1
Sample
e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe
-
Size
5.3MB
-
MD5
099e0502c814215f447660a9fc591361
-
SHA1
a2917fbe5157fee9e2a70258a96f66aa2498c733
-
SHA256
e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b
-
SHA512
e6519b42ff0ed5feafe6bb92d578417468456b849cddce29043835bfa63108f45bd12c35fb5a2f7b2baea3c7bb7c5381c979d6a759232964d64a07edda33fffa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4460 xservice.exe 2740 xps.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe -
autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3928-139-0x0000000000870000-0x0000000000E36000-memory.dmp autoit_exe behavioral2/memory/4460-145-0x00000000000A0000-0x0000000000213000-memory.dmp autoit_exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\PROGRA~2\XPSRAS~1\vp8decoder.dll e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\PROGRA~2\XPSRAS~1\vp8encoder.dll e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File created C:\PROGRA~2\XPSRAS~1\xservice.exe e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\PROGRA~2\XPSRAS~1\xps.exe e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\PROGRA~2\XPSRAS~1\xservice.exe e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\Program Files (x86)\XPS Rasterization Service Component\pwd.txt e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\Program Files (x86)\XPS Rasterization Service Component\xps.pdb xps.exe File created C:\Program Files (x86)\XPS Rasterization Service Component\Log(13.02.2022).txt xservice.exe File opened for modification C:\Program Files (x86)\XPS Rasterization Service Component\Log(13.02.2022).txt xservice.exe File opened for modification C:\Program Files (x86)\XPS Rasterization Service Component\Screen(09_14).jpg xservice.exe File created C:\PROGRA~2\XPSRAS~1\settings.dat e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\PROGRA~2\XPSRAS~1\settings.dat e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File opened for modification C:\PROGRA~2\XPSRAS~1 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File created C:\PROGRA~2\XPSRAS~1\vp8decoder.dll e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe File created C:\PROGRA~2\XPSRAS~1\vp8encoder.dll e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1996 schtasks.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 4460 xservice.exe 4460 xservice.exe 2740 xps.exe 2740 xps.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe 4460 xservice.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4460 xservice.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 744 svchost.exe Token: SeCreatePagefilePrivilege 744 svchost.exe Token: SeShutdownPrivilege 744 svchost.exe Token: SeCreatePagefilePrivilege 744 svchost.exe Token: SeShutdownPrivilege 744 svchost.exe Token: SeCreatePagefilePrivilege 744 svchost.exe Token: SeTakeOwnershipPrivilege 2740 xps.exe Token: SeTcbPrivilege 2740 xps.exe Token: SeTcbPrivilege 2740 xps.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe Token: SeRestorePrivilege 4928 TiWorker.exe Token: SeSecurityPrivilege 4928 TiWorker.exe Token: SeBackupPrivilege 4928 TiWorker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4460 xservice.exe 2740 xps.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3928 wrote to memory of 1932 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 88 PID 3928 wrote to memory of 1932 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 88 PID 3928 wrote to memory of 1932 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 88 PID 1932 wrote to memory of 1996 1932 cmd.exe 90 PID 1932 wrote to memory of 1996 1932 cmd.exe 90 PID 1932 wrote to memory of 1996 1932 cmd.exe 90 PID 3928 wrote to memory of 4460 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 92 PID 3928 wrote to memory of 4460 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 92 PID 3928 wrote to memory of 4460 3928 e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe 92 PID 4460 wrote to memory of 2740 4460 xservice.exe 95 PID 4460 wrote to memory of 2740 4460 xservice.exe 95 PID 4460 wrote to memory of 2740 4460 xservice.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe"C:\Users\Admin\AppData\Local\Temp\e88222cf5d0cb1814f581b37a3aad63e7e17d25d308281960b7551a8295d030b.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Create /SC ONLOGON /TN "XPS Rasterization Service Component" /TR "C:\PROGRA~2\XPSRAS~1\xservice.exe" /RL HIGHEST2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN "XPS Rasterization Service Component" /TR "C:\PROGRA~2\XPSRAS~1\xservice.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1996
-
-
-
C:\PROGRA~2\XPSRAS~1\xservice.exe"C:\PROGRA~2\XPSRAS~1\xservice.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\XPS Rasterization Service Component\xps.exe"C:\Program Files (x86)\XPS Rasterization Service Component\xps.exe" -second3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:744
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4928