Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14/10/2022, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe
-
Size
17KB
-
MD5
6de66ee30f5c8b83e773bd9965aa215d
-
SHA1
e48ddc220ffa9b86a29aeac4d47d0ddeb2409215
-
SHA256
03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d
-
SHA512
2c3c2abe48f9601f7931529fcd5cd3cf694b80e7b6f8b8c5be0105809ea2f3b802fcfeb4e9ba65e8fc74c224a2b63935adab9544ca111534ebd08f6452b3c9a4
-
SSDEEP
384:eyRq2cZsjE1XIJ0NppznwGvn3OspWzZWjEZ69D:7dJgfdTPu0EZ4D
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\help.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\setx.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\psr.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\PING.EXE 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\findstr.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\runas.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\explorer.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\mshta.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\calc.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\Dism.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ntoskrnl.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\sethc.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\msra.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\dvdupgrd.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\label.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\cipher.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\PushPrinterConnections.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\write.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\wscript.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\ehome\ehvid.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\fveupdate.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\write.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\ehome\ehexthost.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\ehome\ehrec.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\ehome\Mcx2Prov.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\hh.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\ehome\ehmsas.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe File opened for modification C:\Windows\ehome\ehprivjob.exe 03eff105ba07f50c06321afc48fe0fddd3c3a565369ba108b8c114088f3b363d.exe