Analysis
-
max time kernel
1721s -
max time network
1570s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 01:21
Static task
static1
Behavioral task
behavioral1
Sample
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
Resource
win10v2004-20220414-en
General
-
Target
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe
-
Size
52KB
-
MD5
017dc4ca721b009fc192e818168776fd
-
SHA1
61a982bbc9dd517badcbc1dbcfff49761fcb5190
-
SHA256
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a
-
SHA512
f15907d9013c93495c6414e63c73455515aa7345afbc52db821855d5ea9c1d0aad9994234e9364d9ae8a737265cf4bc2b197b6cf84bb8ad907b9ee4afbce9ca5
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\RbuXxy.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
RbuXxy.exepid process 5052 RbuXxy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RbuXxy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation RbuXxy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RbuXxy.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe RbuXxy.exe File opened for modification C:\Program Files\7-Zip\7zG.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe RbuXxy.exe File opened for modification C:\Program Files\7-Zip\7z.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe RbuXxy.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe RbuXxy.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe RbuXxy.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe RbuXxy.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe RbuXxy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe RbuXxy.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe RbuXxy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe RbuXxy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exeRbuXxy.exedescription pid process target process PID 556 wrote to memory of 5052 556 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 556 wrote to memory of 5052 556 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 556 wrote to memory of 5052 556 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe RbuXxy.exe PID 5052 wrote to memory of 3068 5052 RbuXxy.exe cmd.exe PID 5052 wrote to memory of 3068 5052 RbuXxy.exe cmd.exe PID 5052 wrote to memory of 3068 5052 RbuXxy.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe"C:\Users\Admin\AppData\Local\Temp\1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeC:\Users\Admin\AppData\Local\Temp\RbuXxy.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\56c81d46.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\56c81d46.batFilesize
187B
MD59290d0148e800a7b0e1b20977a1ab4f7
SHA13f8762da03fe95cf79b820e41589c735df8160ee
SHA25605219171eb40224f9aa7c5523990ca69b8a60e00d6e2a8c73666b6b7a0176f96
SHA512d222bfdf78561307341f83338b7fbf0c2cff729be9e9bea8cc5a115ef6887f8d87632b74e1e9805a7102fc38c9e38de17dfe3fb55dd76c68689044a23fd2e898
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\RbuXxy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/556-130-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/556-135-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/3068-136-0x0000000000000000-mapping.dmp
-
memory/5052-131-0x0000000000000000-mapping.dmp
-
memory/5052-134-0x0000000000F40000-0x0000000000F49000-memory.dmpFilesize
36KB
-
memory/5052-137-0x0000000000F40000-0x0000000000F49000-memory.dmpFilesize
36KB