Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
04/07/2023, 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
easyMalicious2bf13f0abc2f.exe
Resource
win7-20230703-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
easyMalicious2bf13f0abc2f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
easyMalicious2bf13f0abc2f.exe
-
Size
1008KB
-
MD5
692ffc72398db0b1b5aa1b1073036e16
-
SHA1
e91059882e340c656f21b87860aef6b9c1e9ea13
-
SHA256
f245b162bcbba03cb8729275798874b4359084eb5eaf0ba1646b62955ce5b5ab
-
SHA512
eaafc5846fdc2451932f0a56da2c12c788e6bb2cd2cd8373ca9c828b051f3cdbaa346f29cd77e9276bc70e7f7b427d271dfdf944d303e000d60ba1ddd66ecc41
-
SSDEEP
24576:91b/aXWwNaz5VXUozp5WPqSarfFSxUfmYv5b/p:9BFRU0ynGoWfHv5b/p
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" easyMalicious2bf13f0abc2f.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX57E6.tmp easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX57C6.tmp easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\InitializeMount.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5755.tmp easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5765.tmp easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5785.tmp easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe easyMalicious2bf13f0abc2f.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe easyMalicious2bf13f0abc2f.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe easyMalicious2bf13f0abc2f.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5b126345317624479f78fbf30b3a1fe5a
SHA1655c966bf7bbf96ee49c83062d30b9dba17d693c
SHA2568723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301
SHA512d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d
-
Filesize
1015KB
MD5e49913314d3fa5159b0d406f32c2385a
SHA1b83439cd1dad3546b7ce3a230756ae481a51a66d
SHA256452260fef39278d7d3a30a02192bb00449b1e4b59d737fe7e86b5985018674e9
SHA512e7e80e5ed155d0dabefdbe7d92d66bc30216dbaf743247e91c57984e0c184bac4d912d0dd6e791d3776b0458096ce4f44b926a10d62ad8ef33e57c9b722b6a1a