Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe
-
Size
23KB
-
MD5
31813436acd6f249222f3aee0884cfc0
-
SHA1
3be5bc981ff4bbbd94d2d537f1229e19e2dd3de7
-
SHA256
5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29
-
SHA512
bd094625c9a98cbfa42a91498a5719ed755a770e8b54739aadecabb78b4d00a1540471ee9bce411a466d3a3c1b7b8f2018fdb0ac54371c73065739b1af180c96
-
SSDEEP
192:hFcNQ8wzI4ErHopJoTRUlnCyKf9Z10uGirMXhM6VxcnW38Q9W2y38WtmW:ANQ8eIPfREcZSvVuW38Q9WnsW0
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dtdump.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\psr.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\subst.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\user.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\label.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\makecab.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\recover.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\explorer.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\sort.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\where.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\winhlp32.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\write.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\bfsvc.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\explorer.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\HelpPane.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\hh.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\notepad.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe File opened for modification C:\Windows\splwow64.exe 5ed7e0055d1f50213226d069f6856f23edbf8e3222ea8447d5ff44e8b964aa29.exe