Analysis
-
max time kernel
113s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 22:54
Static task
static1
Behavioral task
behavioral1
Sample
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
-
Size
96KB
-
MD5
a15a69ec30f76f8c09f30de72645ad20
-
SHA1
0cf7f000f314ab0c7f8413174f6c4f07b06ec50e
-
SHA256
e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275
-
SHA512
0ab2a4bee56f7ad5c8dea414b641be56ae8a0b0420846e0c689ba01d3099eed106a43ebcba281b60b26849b279450d20989eb34cfc86ce7efe44b43120581b45
-
SSDEEP
1536:MqPjvlpp/06w6Px9+3cu9V+gKk6GCq2iW7z:MqPL1/7w6ZAs+VBK3GCH
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000b000000022f28-134.dat aspack_v212_v242 behavioral2/files/0x000b000000022f28-135.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 3192 jQdkri.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation jQdkri.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe jQdkri.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE jQdkri.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe jQdkri.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE jQdkri.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe jQdkri.exe File opened for modification C:\Program Files\Windows Mail\wab.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe jQdkri.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe jQdkri.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe jQdkri.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe jQdkri.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe jQdkri.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe jQdkri.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE jQdkri.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe jQdkri.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe jQdkri.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3192 2992 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 80 PID 2992 wrote to memory of 3192 2992 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 80 PID 2992 wrote to memory of 3192 2992 e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe 80 PID 3192 wrote to memory of 1640 3192 jQdkri.exe 89 PID 3192 wrote to memory of 1640 3192 jQdkri.exe 89 PID 3192 wrote to memory of 1640 3192 jQdkri.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe"C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\jQdkri.exeC:\Users\Admin\AppData\Local\Temp\jQdkri.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\49363685.bat" "3⤵PID:1640
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD518415d07be329797048b4ee648d86544
SHA1ede237df20eeaa552baa3d3297ffb576812de4df
SHA25657e3ad4af3017989b4cd1c8bac2e92ac429733a9a7553099b681bea82ff3712a
SHA512a28e008700bc213b7e565af46572630173255f7b90fbefe71654eaf8d298473a47a45f473158e31ded5ffb13c5fe28fc70eedeefe646f79cae7646466db4c3f4
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e