Analysis
-
max time kernel
144s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
04/07/2023, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
easyMalicious257ad68ecb72.exe
Resource
win7-20230621-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
easyMalicious257ad68ecb72.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
easyMalicious257ad68ecb72.exe
-
Size
847KB
-
MD5
cb42e6d5228ff4dff9927599032b4acd
-
SHA1
6b788ca1eb918aba3effc2531fc31fde09970847
-
SHA256
2807b0352a05a46e97872a589532ff0b5eabd763c335d88c29cc41543c7eb47c
-
SHA512
e372d5ed6ae381ba62487282cb3d611b8e607a989eebe16805629a92ca47d0cfa96855bf643f147cd71d4f3705e77c75d6e2f2129dc2c352e7168e740e8ba0ca
-
SSDEEP
24576:91bVl10+FrG6nlnnSyrQrHQDSqYJD6a2pspV+STK:9X75rNnSDUlass7LK
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" easyMalicious257ad68ecb72.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8CD7.tmp easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8B5F.tmp easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe easyMalicious257ad68ecb72.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe easyMalicious257ad68ecb72.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8D75.tmp easyMalicious257ad68ecb72.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5b4f93f95ffddaa280a813c6d3e0eb6c7
SHA12b38af69005c3773ddd67d3a924a582f962af989
SHA2567a125e14fcd6a1ae3492bd352c7d0fdfbe62fc67d6296f237131e0e2cf7c9041
SHA5122f9c12f87f361b86b0bf966cb4ed369a97f3ea0a2265308308d71f5ad301664aea64461d633e955d0cfdb63342802c5f7ae35c7199be89a1457cf3f8c9658803
-
Filesize
880KB
MD5247dc7343c74f51190bbb4d46bc4f9a4
SHA151bab23cb2077f804e661c4a6c3ccc450465631e
SHA25618b0c77725200b158366b45a80c1a1a5d8d7d77d5e49436d7d292a06b066f40a
SHA51201214d2b736b38c25be7a627954a8fc7c555a6ee4594bb95b5bb0d945f4599695f1c534bd060b183ee504489edf44a04f61b30733cf73ef3916ba6fd440cf172