ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3

General

Target

ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
Size

34KB
MD5

52ed881482fef0d7f49b0c659307c0a0
SHA1

ff253784d8b4ce424788b2f24f393303fce0ab2c
SHA256

ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3
SHA512

9f770acb235b72b42886b38947608eed7b92ac0fa89e4d9b76ffd56e2c289fb039f0aa9b8c1d6a20b89cc56a373a4d4df5d9b15a42da337dcf552d7d01212616
SSDEEP

768:6U+QYL+KprX1EAjC4GXe1m0tQzHfzFC8y/ByL7bVfDrkL8:6UVYL+KprX1jm0tQrfR1y/chfDrv

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

Processes:

ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\HOSTNAME.EXE	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\regedt32.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\cleanmgr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\dplaysvr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\extrac32.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\fsquirt.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\shrpubw.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\TsWpfWrp.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\openfiles.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\Register-CimProvider.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\relog.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_ssp.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\TokenBrokerCookies.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\attrib.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\dcomcnfg.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\iexpress.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\msfeedssync.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\getmac.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\InfDefaultInstall.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\mtstocom.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\odbcconf.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\tzutil.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\cmstp.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\hh.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\mavinject.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\user.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\wermgr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesPerformance.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\winver.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\bootcfg.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\bthudtask.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\iscsicpl.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\mfpmp.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\ROUTE.EXE	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SearchFilterHost.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\subst.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\autoconv.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\convert.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SystemUWPLauncher.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\AtBroker.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\RdpSa.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\netiougc.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\tar.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\Taskmgr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\waitfor.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\diskperf.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\LaunchWinApp.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\efsui.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\systeminfo.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\replace.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\sdchange.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\Dism.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\EaseOfAccessDialog.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\quickassist.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\psr.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\SysWOW64\secinit.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe

Drops file in Windows directory 8 IoCs

Processes:

ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe

description	ioc	process
File opened for modification	C:\Windows\bfsvc.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\explorer.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\HelpPane.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\hh.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\notepad.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\splwow64.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\winhlp32.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
File opened for modification	C:\Windows\write.exe	ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe

C:\Users\Admin\AppData\Local\Temp\ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe
"C:\Users\Admin\AppData\Local\Temp\ff0c647d991596b50635b9421d18ba4652f534ec46398e03a9844c7b30955ac3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-132-0x0000000001000000-0x000000000100BB00-memory.dmp

Filesize
46KB

Download
memory/1688-133-0x0000000001000000-0x000000000100BB00-memory.dmp

Filesize
46KB

Download

Analysis

Sharing