Analysis
-
max time kernel
118s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe
-
Size
130KB
-
MD5
20b6cef19462a6232744e77d1edccf26
-
SHA1
c6a6e02ebee52899d3b33d7362a1ed5ded072c27
-
SHA256
450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc
-
SHA512
158135eeb8176f48285bcfe1d0f142b8e159cbb565eb594d6ae3a7a5d6fcbeea0bf4f67b77da530db29fe1650f755b243e0d56b348346714d4f3e789f1d3ee5e
-
SSDEEP
3072:NtI74o0bB/W/e9PR4GC7+ZSsrZUcHQgsm2fGCH:3I749bBea6GS+brZUoAG
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000b000000022e36-133.dat aspack_v212_v242 behavioral2/files/0x000b000000022e36-134.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 4072 iLwyZfL.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation iLwyZfL.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE iLwyZfL.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe iLwyZfL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe iLwyZfL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe iLwyZfL.exe File opened for modification C:\Program Files\7-Zip\7zG.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE iLwyZfL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe iLwyZfL.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE iLwyZfL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe iLwyZfL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe iLwyZfL.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe iLwyZfL.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe iLwyZfL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe iLwyZfL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe iLwyZfL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe iLwyZfL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2268 wrote to memory of 4072 2268 450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe 81 PID 2268 wrote to memory of 4072 2268 450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe 81 PID 2268 wrote to memory of 4072 2268 450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe 81 PID 4072 wrote to memory of 3016 4072 iLwyZfL.exe 87 PID 4072 wrote to memory of 3016 4072 iLwyZfL.exe 87 PID 4072 wrote to memory of 3016 4072 iLwyZfL.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe"C:\Users\Admin\AppData\Local\Temp\450a5777951ba46f37e5587e372e43c847e76b00c370077c367d30af10ef41dc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\iLwyZfL.exeC:\Users\Admin\AppData\Local\Temp\iLwyZfL.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\04c83d92.bat" "3⤵PID:3016
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189B
MD580fab3f1770fed473c3cfa6b1dc38379
SHA195036fcccd15483e4d50072aba7356ca20ffd83a
SHA25684abff4947dcf1cf798833e96e903a219f7d0b9cbc0f5e2b0322a8fd5553ffe9
SHA51290797d6a11fabb0ae2d758889185cdd3a324cab0577a2ccca1fdd304f5687b88bbe2cdf28371a5805f3cf26506650c887f1eb94e70c0c1c391ba837aa901fa78
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e