Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 15:05
Behavioral task
behavioral1
Sample
easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe
Resource
win7-20230703-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe
-
Size
884KB
-
MD5
2ab7091214b0ae5add03b6e353297986
-
SHA1
145de4be7e4206c6ad0fcb0419487fa86353579e
-
SHA256
c4fe37c4c08845f69dd5489287aea066ad8e13747d82f140b24ecc24c7cde105
-
SHA512
6e34681e3d9ac0f6a69b98df3ac4253c440a04eaefbb8baef68e61e50d06bb891aadc19937accbcaaf9c611c0e9d63a0e178cc6281499cb7f9650aced1ae5014
-
SSDEEP
24576:ZMMpXS0hN0V0HiCSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0J:Kwi0L0qi2
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
resource yara_rule behavioral2/files/0x00070000000231d0-137.dat aspack_v212_v242 behavioral2/files/0x00070000000231d2-171.dat aspack_v212_v242 -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\Y: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\G: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\J: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\L: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\E: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\I: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\O: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\S: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\W: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\X: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\Z: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\B: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\N: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\R: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\M: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\Q: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\T: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\U: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\V: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\A: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\H: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened (read-only) \??\K: easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File opened for modification C:\AUTORUN.INF easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HelpMe.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Windows\SysWOW64\notepad.exe.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{37FFC933-8A0C-4455-89B9-5469AEA779B4}.catalogItem svchost.exe File created C:\Windows\SysWOW64\HelpMe.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_EN.LEX.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Internet Explorer\IEShims.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jfxrt.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VBAOWS10.CHM.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWER.DLL.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.war.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.exe easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3912 easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe 3912 easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_30a4193ad7d4218d6eb5dfcc94d97eb2801b1bfa3029b59ec631665f17ea1d22.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:1348
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
884KB
MD5107249c383f6dc71665abea8a2988de2
SHA1fc9cbf3b8f48694d26257a9bf4e28631602b4b5d
SHA256ad21ac97827e7f6b4b68e55155570a8245a100025c3e8d7523de366a8dce4b84
SHA512cd72303718398b66dbb8d6317dce40239fd19ae0824f9d9a1454326cebdbd8c9688c3db2d3509213d126e11490c65032ba6fa7fadbeddb9dd4a7320f57c51c72
-
Filesize
1.7MB
MD53cd158c7feed91de137e2a016453d899
SHA165b698dc0d0c6a2612da3f74bc9f364880d8e315
SHA256ab13a884f35251866ac1f6fee81f103246016a7831c5b1ddcc4d16b4cf6b9078
SHA512c026d8731fc29fb853d07d087a8405b967dd057910fa2959a4d1114b023bbcc9a7f7eac356a45b6f1388eae0cfcb0b676f63824b667109169e0753c300faf274
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47