1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe
Size

328KB
MD5

21c65b7f226243b356d769a0634ffdca
SHA1

85c0da05d75e71d3beeeb4bcfe4174e5e9c15486
SHA256

1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f
SHA512

64d12d55a5f259d81ea3eac8a2530f55aabd44e02caed201bf72af3e6b193a8a5d2a6eacecff299a119bbef04b4c18689cba0b67d37f63ddddbe83a222600f83
SSDEEP

6144:gyH7xOc6H5c6HcT66vlmvqpXsGKLu8NTgq/sW0ulhQaKrYRJbNMSfqYDez+dEfye:ga3tmx1xhQ0M3YDea6/uf72

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2596	svchost.exe
4040	1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe
2072	svchost.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2596	2840	1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe	79
PID 2840 wrote to memory of 2596	2840	1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe	79
PID 2840 wrote to memory of 2596	2840	1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe	79
PID 2596 wrote to memory of 4040	2596	svchost.exe	80
PID 2596 wrote to memory of 4040	2596	svchost.exe	80
PID 2596 wrote to memory of 4040	2596	svchost.exe	80

C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe
"C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe
    "C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe"
    3⤵
    - Executes dropped EXE
    PID:4040

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe

Filesize
293KB

MD5
22633a7f04ee8c75675185af66116c83

SHA1
ae682da25091191eb011a56e5e8fb2f9ddfcda6d

SHA256
71a544631ad51c36794aed5803f25a824d89cc746b0b867101d0aca8522ee00b

SHA512
9ce4c2e5143b8acf4819ddc299a5fcb12596f1cb335468e7355ad77c6151c192a66f545a07008aa9ec1b741f9d6e0e89273b71e6ec3fd6ce0bd61102abc14ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a858d5eb47d470a3435c3acef176b19a6c1db752723e963b645b48c3cad905f.exe

Filesize
293KB

MD5
22633a7f04ee8c75675185af66116c83

SHA1
ae682da25091191eb011a56e5e8fb2f9ddfcda6d

SHA256
71a544631ad51c36794aed5803f25a824d89cc746b0b867101d0aca8522ee00b

SHA512
9ce4c2e5143b8acf4819ddc299a5fcb12596f1cb335468e7355ad77c6151c192a66f545a07008aa9ec1b741f9d6e0e89273b71e6ec3fd6ce0bd61102abc14ef0

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
memory/2596-132-0x0000000000000000-mapping.dmp

Download
memory/4040-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads