Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe
-
Size
704KB
-
MD5
c8491a4667b20977ccc31451e2f87336
-
SHA1
7778810ff976fcd4683385b9f6e41deb1b7de474
-
SHA256
fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf
-
SHA512
9b7eed82f27b2015f92734965de4d219becc7b67cae88dcf0915c1d072f067a592747762d89f3f09e24b228ba5b8e6ffae653c359a68528956c859a6468f653f
-
SSDEEP
12288:fLln6bLhWmjWQWeY5NoMR/UFp0Q8esaCbX0qw5isBzpC:jlniJTWeYT/UFpIeXK0Xhx
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\RCXB64.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Windows Media Player\RCX72AB.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCX79DF.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXDA7.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX970B.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Windows Journal\RCX6563.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX2073.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX8AB3.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Google\Update\Install\{1356F306-EAE0-4B1A-B71F-5790065C0F0D}\chrome_installer.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXEF62.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\7-Zip\7z.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1CF0.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Windows Journal\Journal.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Windows Media Player\wmprph.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX32F.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXEF70.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\DVD Maker\RCX8106.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXE90.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX2D0.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXAEE1.tmp fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Windows Media Player\wmpenc.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Windows Media Player\wmplayer.exe.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.ico fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 112 fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe 112 fd7ad5b6b8f757bd3ff95a23f8b56371a70b624ffe248706a4a1f514f8c5a1cf.exe