Analysis
-
max time kernel
12s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14/10/2022, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe
-
Size
17KB
-
MD5
6971f7d054acd78568c708cabe629a83
-
SHA1
c1b6d65e0dab41db8bd204f3e6f225fffcf17692
-
SHA256
e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f
-
SHA512
6a2a042bb33a56d6f7ce7837404d88b6b02b5b0195576777400ee1ac68340778a117bb03411002757b661ccc553f960a35f48353f0c7d947d25b46d0ec1bb944
-
SSDEEP
384:PDfjem6rTUKrYXNPDzbRTO4qVdNEtzvWIBwE8akEBqm7WGsZ69j:P7j0EXNPDzbRT5qVdNEtzvWIBwnaFqmb
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\PATHPING.EXE e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\dnscacheugc.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\cttune.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\efsui.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\print.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\label.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\choice.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\explorer.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\sethc.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\verifier.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\secinit.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\svchost.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\makecab.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\user.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\PING.EXE e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\relog.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\resmon.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\setup16.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\whoami.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\ftp.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\psr.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\userinit.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\comp.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\instnm.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\mmc.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\diantz.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\logman.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe e2cd29d156de6e847aa18936bb95e96d4d1430c417a745a1bd1f34425e81096f.exe