Analysis
-
max time kernel
1628s -
max time network
1631s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 01:21
Static task
static1
Behavioral task
behavioral1
Sample
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
Resource
win10v2004-20220414-en
General
-
Target
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
-
Size
52KB
-
MD5
017dc4ca721b009fc192e818168776fd
-
SHA1
61a982bbc9dd517badcbc1dbcfff49761fcb5190
-
SHA256
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a
-
SHA512
f15907d9013c93495c6414e63c73455515aa7345afbc52db821855d5ea9c1d0aad9994234e9364d9ae8a737265cf4bc2b197b6cf84bb8ad907b9ee4afbce9ca5
Malware Config
Signatures
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
RbuXxy.exepid process 908 RbuXxy.exe -
Loads dropped DLL 5 IoCs
Processes:
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exeRbuXxy.exepid process 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe 908 RbuXxy.exe 908 RbuXxy.exe 908 RbuXxy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RbuXxy.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe RbuXxy.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe RbuXxy.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE RbuXxy.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe RbuXxy.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe RbuXxy.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE RbuXxy.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe RbuXxy.exe File opened for modification C:\Program Files\Windows Mail\wab.exe RbuXxy.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe RbuXxy.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe RbuXxy.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe RbuXxy.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE RbuXxy.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe RbuXxy.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE RbuXxy.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE RbuXxy.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe RbuXxy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exeRbuXxy.exedescription pid process target process PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 1280 wrote to memory of 908 1280 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe PID 908 wrote to memory of 1664 908 RbuXxy.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe"C:\Users\Admin\AppData\Local\Temp\1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeC:\Users\Admin\AppData\Local\Temp\RbuXxy.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4a254e91.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4a254e91.batFilesize
187B
MD566cf777a6a543383ba39307aa1dc54d1
SHA19df5e913c9cb72207ff7eb87ac7556d749152a4e
SHA256b55e4acc172ecd689d8a3c30223c32874e75e2351ce8c8241af0f1d5f24cb01e
SHA512b62e223a1200e5073a5d0260149d4dc937b2c2e343c676de338f09a496fb95fb711f62f735bf7fba773ce7f23d3b3bea5e5765e87f5c1beffa3e46dc8f8882d6
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/908-65-0x0000000001180000-0x0000000001189000-memory.dmpFilesize
36KB
-
memory/908-66-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/908-67-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/908-69-0x0000000001180000-0x0000000001189000-memory.dmpFilesize
36KB
-
memory/908-57-0x0000000000000000-mapping.dmp
-
memory/1280-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/1280-64-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1664-68-0x0000000000000000-mapping.dmp