Analysis
-
max time kernel
119s -
max time network
38s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 17:18
Static task
static1
Behavioral task
behavioral1
Sample
460a1s0ssssd7da.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
460a1s0ssssd7da.exe
Resource
win10
General
-
Target
460a1s0ssssd7da.exe
-
Size
717KB
-
MD5
a8569bc863ee5c29671bbac230ee8d90
-
SHA1
ece5c2505319d3abe8bb081f325c4a42f61dd6db
-
SHA256
c35b8114cf20d7683905224a84263fdff99577ce69a1b1a94e66f525c38f31ce
-
SHA512
5a510640357931044bc471cd5664b91869ba405682d7847e9fb7081a865ccd6b9a37bb022e5c92e9616002029ae9c29a46aec7ff0e9d14160ce758146c717205
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?QQQQQQQQ
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Drops startup file 1 IoCs
Processes:
460a1s0ssssd7da.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt 460a1s0ssssd7da.exe -
Enumerates connected drives 3 TTPs
-
Drops file in Program Files directory 12093 IoCs
Processes:
460a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Composite.thmx 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWSHM.POC 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSGR3FR.LEX 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\44.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10256_.GIF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\FAXEXT.ECF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_center.gif 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar 460a1s0ssssd7da.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287642.JPG 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DISTLIST.CFG 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.POC 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\LEVEL.INF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\default.jfc 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB9.BDR 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT 460a1s0ssssd7da.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBPAGE.DPV 460a1s0ssssd7da.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF 460a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\ClearExit.vdx 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198377.WMF 460a1s0ssssd7da.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png 460a1s0ssssd7da.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll 460a1s0ssssd7da.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\Read_Me.txt 460a1s0ssssd7da.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\Read_Me.txt 460a1s0ssssd7da.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\Read_Me.txt 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF 460a1s0ssssd7da.exe -
Drops desktop.ini file(s) 40 IoCs
Processes:
460a1s0ssssd7da.exedescription ioc process File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 460a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Links\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Program Files\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Documents\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Music\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IQD6DIKV\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 460a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 460a1s0ssssd7da.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
460a1s0ssssd7da.exedescription pid process target process PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe PID 1436 wrote to memory of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
460a1s0ssssd7da.exedescription pid process target process PID 1436 set thread context of 1672 1436 460a1s0ssssd7da.exe 460a1s0ssssd7da.exe -
Suspicious behavior: EnumeratesProcesses 4510 IoCs
Processes:
460a1s0ssssd7da.exepid process 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe 1672 460a1s0ssssd7da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\460a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\460a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\460a1s0ssssd7da.exe"{path}"2⤵
- Drops startup file
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵