Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2023, 11:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
Resource
win7-20230621-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
-
Size
1.6MB
-
MD5
160b58b58d0c37944ad030dc27548c11
-
SHA1
91f0e5896a9f30cd4294c9389cbbd7572e6264e5
-
SHA256
e036ae5b66f446b921133e33d7b8e9f9aa4acb40aba12a5987150127611bf7fb
-
SHA512
104219beea895629976cdf307433b42f7bf3d49bf8a5353eaa3139d970ffd9fe7f909d144b0bcbca57a1525543102dba6a05f24f6ecfb7faa7b8f896adc4f756
-
SSDEEP
49152:55tLuoO1/5ZGiqE0tixMUsMS5zDCsRXrciTtMJm2/O3YI:zvOl58VdtiDs3JXr7hMJRm3YI
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9FB0.tmp 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXA08E.tmp 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\sIRC4.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\mip.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\MavInject32.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MavInject32.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXA00F.tmp 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9FD0.tmp 0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5b126345317624479f78fbf30b3a1fe5a
SHA1655c966bf7bbf96ee49c83062d30b9dba17d693c
SHA2568723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301
SHA512d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d
-
Filesize
1.6MB
MD5697e42a3bf0f3893c8a589a7316346d9
SHA1a1600ce64105e019d74c31e8576696fb5e31ba1a
SHA25604e8de80cbe2153c2be7820b455d1bd302eb092c0b846061db1e57eb9aac76d4
SHA512a4366c4326deac8af4193a1c11877a7645248cdd9252570ef720f5b3f89f37cc08a41a6333a1cfbc94ddd5429401c0c61125619157e73719ea7d19d1876986dc