Analysis
- max time kernel
141s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe
- Size 30KB
- Sample221129-klcvnach73
- SHA256 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13
- MD5 2b4fc075bef234dc7079271dde5cdbc0
- SHA1 dce2525909f89182cd8a7848b495f663f31a7919
- SHA512 87777c769e251a62116cc94d46f5e3e2c59091a36fc470737d475fac3ecf905211b6ab6ab29c8e8a2851be8f2789ec8fff1801e0a8ed04ab53ce5ee35bb68751
- SSDEEP 192:0TD0cOQ2IwkW8jAbKpWwD42FC/8eFWY4Wgh9IBcdtR3eFkwu:pcZR9jyKpWwDjFlyWY4WXc/R3eF0
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\autoconv.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\systray.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\setx.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\label.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\psr.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\hh.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\mavinject.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\curl.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\replace.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\runas.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\cipher.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\resmon.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\secinit.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\userinit.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\recover.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\reg.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\splwow64.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\winhlp32.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\write.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\bfsvc.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\explorer.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\HelpPane.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\hh.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe File opened for modification C:\Windows\notepad.exe 6f23d2dd47466f94df4a70f7dcd2f47822c4a92cfdf4440fc0445d6b299bda13.exe