Analysis
-
max time kernel
261s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 09:37
Behavioral task
behavioral1
Sample
cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe
-
Size
1.6MB
-
MD5
af8ddefff95f41f2498d660cbed5942a
-
SHA1
3a6c65beb6b52291e58fbc65df201513e7c314f5
-
SHA256
cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe
-
SHA512
1f658642e61442df11ae92d8e5f8316281eca53951b12856186521674b89697547a453f45abc0baf8a35eb7b3d4ab546c11a62ad98143a134d1a594ba1ea31bf
-
SSDEEP
24576:X9ewX9ewL2zt9ewX9ewL2zgnTrQf6GXaewsAj6c8iHNFpl:zSLT8f6Hlj6c8MNFD
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\7-Zip\7zG.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\7-Zip\Uninstall.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe$ cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1492 cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe"C:\Users\Admin\AppData\Local\Temp\cab1673b4dbbf708ddc539ceb6b4c0c95b57b1524b169eb35ef61fb910184ebe.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1492