Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe
-
Size
196KB
-
MD5
0ddc2605d02cb523d09447dba347b9b0
-
SHA1
f61c533644d71051063d92e56cab3147a0868ee3
-
SHA256
525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2
-
SHA512
3803203320ef9dae5d01a86f7b084675dd38171398744780d49159c1fb84573010b0962b8e463eec71b00f53957e9e838b10ca489ec698d829d96f2739430b84
-
SSDEEP
3072:jvCgNn/vIsb9fQ02WR5fsKeEAStZeEiN/jshzUnMPzQtOq/RcGCH:D/vIsQ02atLtZetZsdzu/b
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0006000000022e60-134.dat aspack_v212_v242 behavioral2/files/0x0006000000022e60-135.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 4316 OIOpXy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation OIOpXy.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe OIOpXy.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe OIOpXy.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE OIOpXy.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE OIOpXy.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe OIOpXy.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe OIOpXy.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe OIOpXy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe OIOpXy.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe OIOpXy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe OIOpXy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe OIOpXy.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe OIOpXy.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe OIOpXy.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe OIOpXy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe OIOpXy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe OIOpXy.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe OIOpXy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE OIOpXy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe OIOpXy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1316 wrote to memory of 4316 1316 525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe 81 PID 1316 wrote to memory of 4316 1316 525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe 81 PID 1316 wrote to memory of 4316 1316 525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe 81 PID 4316 wrote to memory of 3968 4316 OIOpXy.exe 82 PID 4316 wrote to memory of 3968 4316 OIOpXy.exe 82 PID 4316 wrote to memory of 3968 4316 OIOpXy.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe"C:\Users\Admin\AppData\Local\Temp\525c54768d9fb600dfbc477b793c6d5442890da2c80f08056f24ab825a518ef2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\OIOpXy.exeC:\Users\Admin\AppData\Local\Temp\OIOpXy.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\17212b32.bat" "3⤵PID:3968
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5153cc1e802ba0ac603b0199b2c60a641
SHA16976c5c34c7e7d3245443c4c2607403f938eaa66
SHA256f35bf7aa36f3d580e3098e85c82a1524b0729cacf0c127492f407dd5f6f766c4
SHA512c5ee86b90aeaf424c7e168b7386adc9dd687e397ba104e623cbbc7d63bb05bb013cd6595fbf478b9370f7c159629514bd8e3dcb0abdb7593d3ff977df7678f20
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e