d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Size

76KB
MD5

6a256739b398dcf06a1f0e9c2a186e60
SHA1

447b63f402515083ec7f30e54ca791c6e7d0836a
SHA256

d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9
SHA512

12a93adb49a65bf26ea46baf879988684ea11b1372cf8d40848df366095862c009603bc2da3b762a4a2e68591b40a9c8bd0c129e4d069324338cb258666b0da8
SSDEEP

1536:+zBBBPOS8imfKfIABK6XI3GI2i0uqfg0bycvtQjEErxTWDTMqhGKYIZTET8x:+zBBBPOS8isoLuGI27fg01mjBkMqhGKn

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
File opened for modification	C:\Program Files\DebugUnpublish.htm	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
File opened for modification	C:\Program Files\FormatCheckpoint.htm	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{580D7F33-DB43-98DF-12B1-F6898025595F}\LocalServer32	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{580D7F33-DB43-98DF-12B1-F6898025595F}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe"	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "ejshstwesebtvbhe"	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{580D7F33-DB43-98DF-12B1-F6898025595F}	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{580D7F33-DB43-98DF-12B1-F6898025595F}\ = "wxthnxrqnkstvblq"	d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe

C:\Users\Admin\AppData\Local\Temp\d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe
"C:\Users\Admin\AppData\Local\Temp\d08d8dee77534caa529f504dd1f7ebcc944684ce24ac673f51f89e80cc5afca9.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1304-133-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/1304-134-0x00000000001E0000-0x00000000001FE000-memory.dmp

Filesize
120KB

Download
memory/1304-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads