Analysis
-
max time kernel
184s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:25
Static task
static1
Behavioral task
behavioral1
Sample
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe
Resource
win10v2004-20220812-en
General
-
Target
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe
-
Size
29KB
-
MD5
3951682cf5287a482a3366be4a8548e0
-
SHA1
fa2a3094b7a8e3f8707e9bea5cf71e070a1f0c88
-
SHA256
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c
-
SHA512
5d11e6af30c7329b7aeb91b0c8c8a8880c65aac300abeff47a401948ee9af1427740a566c766cc41c88579a523908c7d48296aa009c45b5171c9dd16f6fdd68e
-
SSDEEP
384:Nbbz0yJY01Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pf02Y016GVRu1yK9fMnJG2V9dHS8
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exedescription ioc process File opened (read-only) \??\R: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\Q: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\N: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\M: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\L: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\Y: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\W: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\U: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\G: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\T: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\J: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\I: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\H: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\Z: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\V: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\K: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\O: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\F: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\E: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\X: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\S: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened (read-only) \??\P: fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Microsoft Games\More Games\de-DE\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\DVD Maker\es-ES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\DVD Maker\en-US\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Java\jre7\lib\images\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\de-DE\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpenc.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe -
Drops file in Windows directory 1 IoCs
Processes:
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exedescription ioc process File created C:\Windows\rundl132.exe fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exepid process 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exenet.exedescription pid process target process PID 896 wrote to memory of 872 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe net.exe PID 896 wrote to memory of 872 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe net.exe PID 896 wrote to memory of 872 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe net.exe PID 896 wrote to memory of 872 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe net.exe PID 872 wrote to memory of 1648 872 net.exe net1.exe PID 872 wrote to memory of 1648 872 net.exe net1.exe PID 872 wrote to memory of 1648 872 net.exe net1.exe PID 872 wrote to memory of 1648 872 net.exe net1.exe PID 896 wrote to memory of 1232 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe Explorer.EXE PID 896 wrote to memory of 1232 896 fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe"C:\Users\Admin\AppData\Local\Temp\fb7396d305041c5f4f9b6612547791f16ad7e948cbf002edf419d14813cc427c.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵