Analysis
- max time kernel
173s - max time network
229s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2022, 15:16
Behavioral task
behavioral1
Sample
c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe
- Size 21KB
- Sample221107-snxa3sddb6
- SHA256 c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3
- MD5 1854aa0daf15b78eedc88948f5290e01
- SHA1 4052b1915f136457f05b7bc04828e3f95ad0b6a5
- SHA512 a4966c8dab8dbb96a072384699307551c3210b039a07b371bcf58011eb763e85b509abc28c8762a1917e58efd95937d6e5d429e94f2f5d1612cd783af43e597d
- SSDEEP 384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUlfT:SCIqdH/k1ZVcT194jp4xT
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4012-132-0x0000000000800000-0x000000000080D000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\Harry Potter.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\Winamp 5.0 (en).ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\index.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\index.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Kazaa Lite.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\en-US\Harry Potter.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\ICQ 4 Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\ICQ 4 Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\WinRAR.v.3.2.and.key.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\Winamp 5.0 (en).ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Harry Potter.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\index.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\Winamp 5.0 (en) Crack.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\Harry Potter.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\Winamp 5.0 (en) Crack.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\Winamp 5.0 (en).ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\index.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\index.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\Winamp 5.0 (en) Crack.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\Updates\Download\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\index.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Harry Potter.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ICQ 4 Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ICQ 4 Lite.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\Kazaa Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\index.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ICQ 4 Lite.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\Harry Potter.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Kazaa Lite.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Harry Potter.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\index.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\Winamp 5.0 (en) Crack.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Winamp 5.0 (en).com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\Winamp 5.0 (en) Crack.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\Winamp 5.0 (en).ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\Winamp 5.0 (en).ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\index.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\WinRAR.v.3.2.and.key.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\WinRAR.v.3.2.and.key.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\Winamp 5.0 (en) Crack.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\Winamp 5.0 (en) Crack.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\WinRAR.v.3.2.and.key.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Kazaa Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\ICQ 4 Lite.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\Kazaa Lite.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\index.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\Windows\assembly\GAC_MSIL\ICQ 4 Lite.ShareReactor.com c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\lsass.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe File opened for modification C:\Windows\lsass.exe c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe"C:\Users\Admin\AppData\Local\Temp\c7e2e7a990959cfeddd2f1f7c636318675a1f486cc99130787643fcfe9ca1ce3.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4012