Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
07-08-2023 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe
Resource
win7-20230712-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe
-
Size
1.6MB
-
MD5
98e1aa54d57c39b9c83b508937aca117
-
SHA1
611774eea557e0ec4712814656e01c4ec2437484
-
SHA256
753db79559ea037ab3444a572c8610e3114c424d2e5aeee64998ba879c05d74e
-
SHA512
e3eb0de985ddb241478075a943192b0856b04020055620928ff6e0f162023c478a733917cd7893e20462cf2522638844e1eba47aee4bf7f39a3cd41db997ba42
-
SSDEEP
49152:9fgBncC4sjN7dYMDxy7XnTnZKEtNbENHTUJ:Nmn4sjN7m57XjEcNbyi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX63A.tmp Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX69A.tmp Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6BA.tmp Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe"C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_24186a0f1e0b80610f919e6ff9fc6f432a8f5739b5828cbf12ef5520b32ee566.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5b126345317624479f78fbf30b3a1fe5a
SHA1655c966bf7bbf96ee49c83062d30b9dba17d693c
SHA2568723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301
SHA512d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d
-
Filesize
1.6MB
MD59fa600f95417e757f63c6b741cecf5c1
SHA1eccf998351d39fc9b8067f1f6f73c606e152b550
SHA2564335ca98208933987ba63b621d3d605691748b43aaafea15f5bab1732512a3a0
SHA5123b23a8811f193d6e5ee1f5ae1ca7d1595802d369fe1d284085ea634a1bc0ecfc6b216505ac62fc82e3a073690493bf6bd2009547a6fc2fa9b857811af283acd4