Analysis
-
max time kernel
62s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
Resource
win10v2004-20220812-en
General
-
Target
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
-
Size
96KB
-
MD5
a15a69ec30f76f8c09f30de72645ad20
-
SHA1
0cf7f000f314ab0c7f8413174f6c4f07b06ec50e
-
SHA256
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275
-
SHA512
0ab2a4bee56f7ad5c8dea414b641be56ae8a0b0420846e0c689ba01d3099eed106a43ebcba281b60b26849b279450d20989eb34cfc86ce7efe44b43120581b45
-
SSDEEP
1536:MqPjvlpp/06w6Px9+3cu9V+gKk6GCq2iW7z:MqPL1/7w6ZAs+VBK3GCH
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0007000000005c50-54.dat aspack_v212_v242 behavioral1/files/0x0007000000005c50-55.dat aspack_v212_v242 behavioral1/files/0x0007000000005c50-57.dat aspack_v212_v242 behavioral1/files/0x0007000000005c50-59.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1960 jQdkri.exe -
Loads dropped DLL 2 IoCs
pid Process 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe jQdkri.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe jQdkri.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe jQdkri.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe jQdkri.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe jQdkri.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe jQdkri.exe File opened for modification C:\Program Files\Windows Mail\wab.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe jQdkri.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE jQdkri.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe jQdkri.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE jQdkri.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe jQdkri.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 836 wrote to memory of 1960 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 27 PID 836 wrote to memory of 1960 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 27 PID 836 wrote to memory of 1960 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 27 PID 836 wrote to memory of 1960 836 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 27 PID 1960 wrote to memory of 1628 1960 jQdkri.exe 30 PID 1960 wrote to memory of 1628 1960 jQdkri.exe 30 PID 1960 wrote to memory of 1628 1960 jQdkri.exe 30 PID 1960 wrote to memory of 1628 1960 jQdkri.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe"C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\jQdkri.exeC:\Users\Admin\AppData\Local\Temp\jQdkri.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\200b6d33.bat" "3⤵PID:1628
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD57ac40da050e0a9707c60ead82880af6d
SHA1a0a707013056b9420d1182b2001c6c6c9a8efceb
SHA256a4625d6f5ffd30f37c6c7167d840e189fdd90f7e03cecb1b17b0ebb0ae62c801
SHA5127cd198f647daa25e92072c14a2c7b99683cb2f1109925db57e2f939aecdb42b029de4f9b0e506059afcb0ec1497ae62d4e234075fa6cb02eba480ad7c5cbcf7a
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e