Analysis
-
max time kernel
153s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2022 01:28
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe
-
Size
332KB
-
MD5
a3bd608d019d827e4eee68f67f39a444
-
SHA1
6e9874bac7b065a42110cef5c1b060de94123b2d
-
SHA256
2af0bbe87c28664ad5b453eae02d512f770962319673b9c494d85b717a6f9edf
-
SHA512
6b73f10a981a23c9ba0fee05d24b77b15220716172e8b48dc7d2e409e774e6fafbcdced2d5832a21f5863c38f51d553a51e1ad5ae15f7aae5d824366f2a289d8
-
SSDEEP
6144:9kwmZ6RfPyO6qBUnqk5yx+9JjOGNE1STKB7xUbGpn9C+xv0/159Xmj2pO6GInyw:qZ6RfPyO6ZqN7GNsTVxBp9PdK5XmK5p
Malware Config
Extracted
formbook
k6n9
NzUYPBPnE+UWNJX0b/5zZQ==
ZcsDmdfNeiREr4loZ9k=
p4Pecr+pmTFp+Az4AGoSpvqp
4jwUP0ApYThdpDmZcNp+xuej
0tmQjRQKSQbR0N86
MgfR+qwWljDdagbsn8Ukr8bc8A==
shQ3YCpOQPp/9g==
Q4mmwEidJLBJug25c6Vxcg==
OM1kEJDdGNpv7nMy
7FmP1iykTQZ7q0Hq5g==
9lVGWV44H63+A5oGc6Vxcg==
Bs97fiCGUye5Osm9xsOYZnb8SEC+YszE
xJMBmQj3MRDV7MBXzEep
mJpebAH7RkkGGbsZwZ/weg==
u6FXU+JCphyVyCsUBP0Spvqp
B/mwulPBDRm5q0Hq5g==
E+JiHcUb7gR+8A==
BgGOL5SLfQ9BzuPDxzeVKEIuOKDL
wZdfmzTbOcnEF3Mi1QnVpPCo
J63Z+Jv5L+JOhd+zc6Vxcg==
IgTWNszonS66
JJLVZ5p7Ye0esJBFKpB1gp9qPIXB
SJpxmaKEh/Dwe0xyZNE=
xsUw0kqVZjjMGbsZwZ/weg==
oJ5hawcALz0Sck8=
oF0OIcLonS66
wKMurq0dfQ29Fm0k01KpXnwOVkjtHSIsJg==
3spAtPvj0mNaliiTLSP7sQR9+A==
27cSuCoUOfHyYT6YTj4R3zYuOKDL
+QffF/FhHSEZZ00=
JASzumTKM8Zyy91Hw+3a1u93+g==
lIZZlGTVTd1go7VXzEep
PhCGHoZseeSv7Ufz7g==
9GfPX450yp6fEOKD7VGw
ObrDtmPKL5M0orJXzEep
AMt6lj+3ZQyzP9nVn8Ukr8bc8A==
cohLVe5E1vSL+g==
GRSfJ3xdm2hr5e3h80+sesp2lda+YszE
LiepIk4+Pbu6A4c2DfwSpvqp
1GCzadTonS66
aeb9JhiHQ/0SRvJaHf0Spvqp
a9UNouPB9PVWkJQG1sSh
tzEz87wg7gR+8A==
k5MSpgToH/IDgExyZNE=
imO/dAho3XYUU6iBhnhDGC/RD343JA==
PRefVZXonS66
c+hD7BXuNyQxb/Guc6Vxcg==
0BkTBTyNDRG2q0Hq5g==
4bdhB0c5FdLNXkOXUj8dHjtIUoWbHSIsJg==
WSPnIPRmJuZwq0Hq5g==
0LEjqQHx3G55sUxyZNE=
sRD+EO9b7gR+8A==
VzzLZdLonS66
5t9I60w0byjMEWtXzEep
CXOCrZYBawPAGbsZwZ/weg==
WyuEKrEdhXpg2cFXzEep
ifc4vsCPSgYbc00=
SKOdlgStLdZ+jzYO+w==
iYsRh7aXhz0Sck8=
6LNS7gHx7gR+8A==
bMK9y7CHUQLr9lQFzsah
3L95egVeMQuwPZ0Cc6Vxcg==
MH9ZeW3pUtZbb1c=
qa1H5E07ZAnR0N86
api2022.top
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
igyfrxru.exeigyfrxru.exepid process 4824 igyfrxru.exe 2168 igyfrxru.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
igyfrxru.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation igyfrxru.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
igyfrxru.exeigyfrxru.exeipconfig.exedescription pid process target process PID 4824 set thread context of 2168 4824 igyfrxru.exe igyfrxru.exe PID 2168 set thread context of 3048 2168 igyfrxru.exe Explorer.EXE PID 3264 set thread context of 3048 3264 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3264 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
igyfrxru.exeipconfig.exepid process 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
igyfrxru.exeigyfrxru.exeipconfig.exepid process 4824 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 2168 igyfrxru.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe 3264 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
igyfrxru.exeipconfig.exedescription pid process Token: SeDebugPrivilege 2168 igyfrxru.exe Token: SeDebugPrivilege 3264 ipconfig.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exeigyfrxru.exeExplorer.EXEipconfig.exedescription pid process target process PID 384 wrote to memory of 4824 384 SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe igyfrxru.exe PID 384 wrote to memory of 4824 384 SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe igyfrxru.exe PID 384 wrote to memory of 4824 384 SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe igyfrxru.exe PID 4824 wrote to memory of 2168 4824 igyfrxru.exe igyfrxru.exe PID 4824 wrote to memory of 2168 4824 igyfrxru.exe igyfrxru.exe PID 4824 wrote to memory of 2168 4824 igyfrxru.exe igyfrxru.exe PID 4824 wrote to memory of 2168 4824 igyfrxru.exe igyfrxru.exe PID 3048 wrote to memory of 3264 3048 Explorer.EXE ipconfig.exe PID 3048 wrote to memory of 3264 3048 Explorer.EXE ipconfig.exe PID 3048 wrote to memory of 3264 3048 Explorer.EXE ipconfig.exe PID 3264 wrote to memory of 3408 3264 ipconfig.exe Firefox.exe PID 3264 wrote to memory of 3408 3264 ipconfig.exe Firefox.exe PID 3264 wrote to memory of 3408 3264 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.77520.20069.28067.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\igyfrxru.exe"C:\Users\Admin\AppData\Local\Temp\igyfrxru.exe" C:\Users\Admin\AppData\Local\Temp\dkqqrn.zb3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\igyfrxru.exe"C:\Users\Admin\AppData\Local\Temp\igyfrxru.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\caawwo.tqFilesize
185KB
MD57e87de0d663de312611bb198817c039d
SHA15245d45abd227463d7e0734baa4b5e4a72f23117
SHA256cf29186d98d627090bd497c3f53903bc30df30e58c2fbbd5e20c83f593a155ca
SHA512c6b609aecf7b2d5d5c375fc638a139efe6203b6b8bc581629363aae6ee8b418dc70315bf8ce87737b0a1675a349568b837dbfeaba615d4d1f3ae1f4d65ec4f20
-
C:\Users\Admin\AppData\Local\Temp\dkqqrn.zbFilesize
5KB
MD5e2c1f72715c1ba8a81a593353fa4ebeb
SHA10ef5aabb489a82704dea4ca6e33f8d65116848dd
SHA256580a0fd8ac1f558a0421ab266eebb2ed92710f418e6dc769e3b48504970810ec
SHA512f4082ea5c874165b59ceaa9b67a5daaec73f41e62ab312683aff119f90e1f61570e0e658fae945a1b3e7cdf28536e679e6a1263602a2bc58ec7659b7dabd4d37
-
C:\Users\Admin\AppData\Local\Temp\igyfrxru.exeFilesize
276KB
MD508188993d15fa1d98dfc42e3f4f0d15f
SHA10e0d702f549baa70ede7d529177e44c0e24c3952
SHA256068e8af75d257328fd5c8d87c48920d53ff62956502148615df8160f70e03d33
SHA512ab5db72f362af2e1fefa97e93247addc37c0df7f075d15c4fa379963ddf78b22fbda100305f94e211e8536ef57797a7ebf99c0192249bf3dc0455f93b46356e9
-
C:\Users\Admin\AppData\Local\Temp\igyfrxru.exeFilesize
276KB
MD508188993d15fa1d98dfc42e3f4f0d15f
SHA10e0d702f549baa70ede7d529177e44c0e24c3952
SHA256068e8af75d257328fd5c8d87c48920d53ff62956502148615df8160f70e03d33
SHA512ab5db72f362af2e1fefa97e93247addc37c0df7f075d15c4fa379963ddf78b22fbda100305f94e211e8536ef57797a7ebf99c0192249bf3dc0455f93b46356e9
-
C:\Users\Admin\AppData\Local\Temp\igyfrxru.exeFilesize
276KB
MD508188993d15fa1d98dfc42e3f4f0d15f
SHA10e0d702f549baa70ede7d529177e44c0e24c3952
SHA256068e8af75d257328fd5c8d87c48920d53ff62956502148615df8160f70e03d33
SHA512ab5db72f362af2e1fefa97e93247addc37c0df7f075d15c4fa379963ddf78b22fbda100305f94e211e8536ef57797a7ebf99c0192249bf3dc0455f93b46356e9
-
memory/2168-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2168-143-0x0000000000540000-0x0000000000550000-memory.dmpFilesize
64KB
-
memory/2168-137-0x0000000000000000-mapping.dmp
-
memory/2168-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2168-141-0x0000000000A60000-0x0000000000DAA000-memory.dmpFilesize
3.3MB
-
memory/2168-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3048-144-0x00000000084D0000-0x0000000008671000-memory.dmpFilesize
1.6MB
-
memory/3048-150-0x00000000031D0000-0x000000000334D000-memory.dmpFilesize
1.5MB
-
memory/3048-152-0x00000000031D0000-0x000000000334D000-memory.dmpFilesize
1.5MB
-
memory/3264-145-0x0000000000000000-mapping.dmp
-
memory/3264-146-0x0000000000C60000-0x0000000000C6B000-memory.dmpFilesize
44KB
-
memory/3264-147-0x0000000000340000-0x000000000036D000-memory.dmpFilesize
180KB
-
memory/3264-148-0x0000000000E30000-0x000000000117A000-memory.dmpFilesize
3.3MB
-
memory/3264-149-0x0000000000B20000-0x0000000000BAF000-memory.dmpFilesize
572KB
-
memory/3264-151-0x0000000000340000-0x000000000036D000-memory.dmpFilesize
180KB
-
memory/4824-132-0x0000000000000000-mapping.dmp