Analysis
-
max time kernel
292s -
max time network
282s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
Resource
win10v2004-20221111-en
General
-
Target
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
-
Size
1.0MB
-
MD5
3bec3b0adf1e8e1e1ccc8dc6751c16b0
-
SHA1
92adb33367fd4192ce80cc0a734416b29742d050
-
SHA256
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1
-
SHA512
d17cf5d2fcc7b7a7ee3a1aaa9f287caa4703690f4e7089db3022524a3aa7cf589d4f63a62a89f4f8ae1e2cce3a5f043bd82df8c960d545a719abb71097bd3fef
-
SSDEEP
12288:uAAligk8G2carFVcVKcovYGm4+UDQcZiRU0W7AGpnYgzQsAFv0XVE7gPsZpGnnvO:ulKvwrkKc2/IUB7A8AFv0X27HZkv8
Malware Config
Extracted
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\HELP.TXT
http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion
http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion.ly
http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion
https://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion.ly
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exedescription ioc process File opened (read-only) \??\A: 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File opened (read-only) \??\B: 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15274_.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21320_.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ.POC.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Module.xml.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR28F.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Grid.thmx.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0250504.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAIL.DPV.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0292020.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18228_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200189.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9F.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301418.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21325_.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.DPV.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN022.XML.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CASHREG.WAV.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityLetter.Dotx.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00407_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285926.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00792_.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14583_.GIF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe