c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
Size

284KB
MD5

03d41837a110c82a247fd6b18d54ca2d
SHA1

269745f6599ce507d4a4ea448cc0f9944f27405f
SHA256

c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7
SHA512

a75a2bb3d2744c86c0dde837bdedf798b2557a2cdbfcc9b25bb71547dfe14639b4c1817e9e7f589126d96d583dc2d11fc4d23ae37d00f7818fbd3caf169a3b06
SSDEEP

3072:ZaKYVaQzPd5/e7iWeeKfe2xQZEqUgq4YsBrx4ena4vQp9g+Q0/tocDJSKr6Kz+dU:gH7eKfaEL4YsBr3ip9ZUKuXjov

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\olemdb32.dl_	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File created	C:\Windows\SysWOW64\olemdb32.dll	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
4904	c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe

C:\Users\Admin\AppData\Local\Temp\c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe
"C:\Users\Admin\AppData\Local\Temp\c671f249158ce33dbe99ba8b89ffacc00915aa85b3bcc8ee15efae39837141a7.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\olemdb32.dll

Filesize
23KB

MD5
65387b1305f01ede9bce1b664207d5d7

SHA1
19d719d16958e6a1c5367b578cb9ff7700e695bf

SHA256
148f1d2ce99fb0305e53fd24add20cd19cc420e9c1d1b64abf42b456da94cd23

SHA512
cd64957c47979626be9a77b2a2ee2d0b22b72540369a4b6cfe1c1c9f8180b546db0b6e637259dd8f7a09506d738ec57fc34b116e199641c40f55e0d5b40a2a29

Download Submit
memory/4904-133-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4904-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4904-135-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4904-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download