Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe
-
Size
74KB
-
MD5
34c9e333aaffb7e8dd43a0163de04e63
-
SHA1
463c16863715dce33dc8b1fececb7678ea217e02
-
SHA256
ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929
-
SHA512
abbe784fc99d1c61df5ee9b50fb05becc7c7086e9a91ca8cdd90914490e40e40ddb094afd3efe8e92a6906dc47b0b7f2775275ef20bdeabbdabde393d1860f7e
-
SSDEEP
1536:Gly2NxLdxrtBZJfKTDGxN0QDkU3xsRldJ:GlyAjxh0QD3QN
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\DisableConvert.mhtml ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\7-Zip\7z.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\DisconnectCopy.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1800 1584 ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe 28 PID 1584 wrote to memory of 1800 1584 ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe 28 PID 1584 wrote to memory of 1800 1584 ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe 28 PID 1584 wrote to memory of 1800 1584 ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe"C:\Users\Admin\AppData\Local\Temp\ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe"C:\Users\Admin\AppData\Local\Temp\ed48a2196b7f2672493d89d026b4156bfe6e0b704bb8647ae2a7781863205929.exe"2⤵PID:1800
-