Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe
-
Size
521KB
-
MD5
a26db027c9db701cecb5f591f1fc083d
-
SHA1
5d38f0ef3e4280320ec0b6cd3a8300a69e6caf12
-
SHA256
568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0
-
SHA512
7e9a0b230d9f3921cc3575cb3917754737e40daadf2b2877d8b7418d5f0c00464637cda1fa477a545d696604a0388c43599416812dca0a3052a3a259ccd3472a
-
SSDEEP
12288:9rMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9Vt:7ZyCA8CBmn+RrNj9ay5It
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\7-Zip\g7zFM.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\gjjs.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\gchrome_pwa_launcher.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\gjmc.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Mozilla Firefox\gcrashreporter.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\gjps.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\gcom.oracle.jmc.executable.win32.win32.x86_64_5.5.0 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\RCX402B.tmp 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\guninstall.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\gappvcleaner.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\gchrmstp.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\gjar.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Mozilla Firefox\gcrashreporter.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\gchrome.exe.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\gjhat.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\Office16\gOSPPREARM.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\gSQLDumper.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\7-Zip\g7zG.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\gLICLUA.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\gchrome.exe.sig 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\RCX1507.tmp 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\gjmap.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\gjstat.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\gchrome_proxy.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\gelevation_service.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\RCX1556.tmp 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\gextcheck.ico 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\gidlj.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\bfsvc.exe 568d0d2a9ffd73fc480d29168f1e6404b388f529324f254d9a1f9b476d2924e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.