Analysis
-
max time kernel
202s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe
-
Size
5KB
-
MD5
a02e55aed02099d1b6de49c42e498a12
-
SHA1
95f973ef7dce736f95535eb109f74da534d043d4
-
SHA256
8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6
-
SHA512
652d143316aeb82acf3e99116f71455fc8774d7cb71b7f3d6c930d34a890ee0bb4280e77ba4d2301841b07e928338c55c004d4603bc9e7ebe8bb8503ee8260f7
-
SSDEEP
96:9UKFhEpEWgpNo6WwJ6HJwoEfuntZgsxNVcW:9UKHEqWUnWwcJ6fuFNVT
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{97804B88-3410-47C4-9251-7A6CDF0AC106}\chrome_installer.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1504 1976 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1976 2016 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 28 PID 2016 wrote to memory of 1976 2016 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 28 PID 2016 wrote to memory of 1976 2016 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 28 PID 2016 wrote to memory of 1976 2016 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 28 PID 1976 wrote to memory of 1504 1976 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 29 PID 1976 wrote to memory of 1504 1976 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 29 PID 1976 wrote to memory of 1504 1976 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 29 PID 1976 wrote to memory of 1504 1976 8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe"C:\Users\Admin\AppData\Local\Temp\8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe"C:\Users\Admin\AppData\Local\Temp\8ac70b0660835947fb8511ac0ac594f1593dd3545a78fa7decda9e2f07ba73c6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1003⤵
- Program crash
PID:1504
-
-