Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe
-
Size
1.3MB
-
MD5
a22be08443b839b0740543decf11e8e7
-
SHA1
45e493abbb60d13f26acc5bb8ac1c2a7cf9446a7
-
SHA256
d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c
-
SHA512
3b7de4f9ec7c1d656be04304c3171f9cdcc274a5aec623ed0404de0dc903c1dfe326be7d80d15a253ad8c28035b1b8ab02b9b05b291ecfcfda1ad25313bc6aec
-
SSDEEP
24576:mQjd3PkYkG0lugB0eYNwNG/6uffkLlkPJbFYogweI26dl1c:tjNN0luY0rGN/j4Jp54I2slG
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4204 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre1.8.0_66\bin\klist.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX39E4.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\7-Zip\7z.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX2033.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXFFA.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\RCX1D99.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\RCX616E.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXCC68.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX76E1.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\RCXB52.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\RCX8520.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXD67A.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\RCX1940.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX1FC4.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\7-Zip\7zFM.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\RCX8F6D.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\RCX8A07.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXD57F.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\7-Zip\RCXBC34.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe.ico d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXE9ED.tmp d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2224 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe 2224 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2224 wrote to memory of 4204 2224 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe 80 PID 2224 wrote to memory of 4204 2224 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe 80 PID 2224 wrote to memory of 4204 2224 d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe"C:\Users\Admin\AppData\Local\Temp\d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe.exeC:\Users\Admin\AppData\Local\Temp/d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe.exe2⤵
- Executes dropped EXE
PID:4204
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe.exe
Filesize616KB
MD529d4f8e25d48cf53699224c773caf456
SHA1f8b49208b675819d3fff435149f91a2cb5f98f48
SHA256128f4a48a36defa759a4a6d4590e663b28e3370c390eaa18708e04a98e69abcd
SHA512ce5696330fca1d2b13a7ab16b9557c7e233ff217ada2c2a374d5fe9f612389c225015309eed84bbadf24e0e1449489b73a14afe3946f69cbd6fa0a4b817e3081
-
C:\Users\Admin\AppData\Local\Temp\d760f7233f41df2c756cf14ea9d163be4bafbdf8f5b1a9b207d5e4281d807f4c.exe.exe
Filesize616KB
MD529d4f8e25d48cf53699224c773caf456
SHA1f8b49208b675819d3fff435149f91a2cb5f98f48
SHA256128f4a48a36defa759a4a6d4590e663b28e3370c390eaa18708e04a98e69abcd
SHA512ce5696330fca1d2b13a7ab16b9557c7e233ff217ada2c2a374d5fe9f612389c225015309eed84bbadf24e0e1449489b73a14afe3946f69cbd6fa0a4b817e3081