Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 23:29
Static task
static1
Behavioral task
behavioral1
Sample
ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe
-
Size
1.4MB
-
MD5
aa30522a15b33ff7e01cc5c9df77d0d4
-
SHA1
5b06d236a1e2a60794017f8aa2320f80a5de63d1
-
SHA256
ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0
-
SHA512
220d11df5da6c508595a15c0cd4b5448b5a0781cd42f45bd5f00df72c06f55ff7d929acd91721915f3675a3f5ddb4605579a32b5c86e1bb528b1023f2e78e575
-
SSDEEP
24576:51bdlrqA7SxVAj6Y+zOsCWqmpXD9H2nKsb1dOoH0hKDocF31ZBOayEQ2q:5drfe+63SopXdqb/QhAoo31Cax0
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX19F9.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX19BA.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX199A.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX1A7A.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\sIRC4.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX1A3A.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX1A1A.tmp ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe ec702fd5e584e4e4e42ca9f5cae1197597c89ffa14cf78d072a52b1d0e6022d0.exe