Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 18:01

General

  • Target

    9f29bd6bd063f6568974b340f844828d_JC.exe

  • Size

    406KB

  • MD5

    9f29bd6bd063f6568974b340f844828d

  • SHA1

    ce3e201272a348c451c866a173710bfbc757c07e

  • SHA256

    e2187e029813c566129795320542950ee98447e6d6d26b314d895ea0e303be2b

  • SHA512

    9b8b7c8901c97c228417444e6804bc288dbb9131bf2136d4b492d1a7f853a5b314e808f9ca12af50d100e521981cef212d7d1fe6b972c1e379d955f102c972dd

  • SSDEEP

    3072:Rxv/y9LJ3tGXRvjxCb5NgXDY7uSK4aqTB+BKtW9lMYwIP+XYcpyk7RKKtW9lMYwz:bamlKgzeYqTCNs6+X7jINs6+X7j

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f29bd6bd063f6568974b340f844828d_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\9f29bd6bd063f6568974b340f844828d_JC.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    448KB

    MD5

    d4f15724314368b667249bc211fa7719

    SHA1

    3b8ad5c6ff4fdc68e28625dc76c1413c59d4fde2

    SHA256

    c235062076006c59f1bda173867a49f251e1e5ab30d25bc258cbdb6802433651

    SHA512

    bf8b1075dc1430d00e2382f62da5421bd93964ac77e442859eb5c7812eb12dc6760dc6b255a31de9703f4cb0eed848623e459d34962a95c36426f7e9ed22dc32

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    847KB

    MD5

    c8f40f25f783a52262bdaedeb5555427

    SHA1

    e45e198607c8d7398745baa71780e3e7a2f6deca

    SHA256

    e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316

    SHA512

    f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

    Filesize

    118KB

    MD5

    f45a7db6aec433fd579774dfdb3eaa89

    SHA1

    2f8773cc2b720143776a0909d19b98c4954b39cc

    SHA256

    2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

    SHA512

    03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX6B18.tmp

    Filesize

    224KB

    MD5

    61638126ef4fab72adddbe8053d1729b

    SHA1

    129133f1b3e743999488f4bd3440cbb2c6fc49f2

    SHA256

    449d2f7dd35dfb8a5c06dd64613aed7dda90fa4cf48238dca70893672987941f

    SHA512

    c7c464a8553aaf586162a98ee74708b6cdb02588d99809656e06ed1fcc974a17cfb31d9f06540c218a91c85fdcf517ebc8877d96941debde26549f68a4e0fc0a

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

    Filesize

    4.3MB

    MD5

    2161730a7ae00a1fb8c5020a43be949f

    SHA1

    8db6b820472cdfa266c874e0d3a9395412995aa1

    SHA256

    07e7896b2304e3b9966294a02d2ed32f41994ee7bd0a284e4160743edaeb9e15

    SHA512

    aa3659b6184f4273b7fcf1f7d2cd0a5a9129b8856d15e4ca8904b709e85cd432538ce0510ca9777760a1a9d5391671232a79908860e7d665260a54910f6fea5a

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

    Filesize

    1.6MB

    MD5

    527e039ba9add8a7fac3a6bc30a6d476

    SHA1

    729a329265eda72cada039c1941e7c672addfc19

    SHA256

    4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94

    SHA512

    9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

    Filesize

    1.5MB

    MD5

    948593dc87458c8bbdf0580a5bb9d691

    SHA1

    abd9840bc223efbf027f0e17deeb2ccae9e95c4e

    SHA256

    3e5660f143ecec2e4becf55cdd4ae4fd4a8b78702ed07b6e23a5dac36070dd07

    SHA512

    6c5f821e90860643c2ba412cd7d3c1d9635f0ce213ac2053905f7822a56bed8e389f7c12f51ecdeadadaf6eb5b1945c8c5ccd50c6858437688e741e48570fdac

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

    Filesize

    1.6MB

    MD5

    ec6386b63c3a5ffe0577905e94262c3a

    SHA1

    8f8c428d0e7f32c9d733ca28384ded413a060588

    SHA256

    302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4

    SHA512

    ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    2.8MB

    MD5

    095092f4e746810c5829038d48afd55a

    SHA1

    246eb3d41194dddc826049bbafeb6fc522ec044a

    SHA256

    2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

    SHA512

    7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    1.5MB

    MD5

    1f5e7e4fc3ef17c5eee087adbc3d8bb5

    SHA1

    314e34249b4fd747780d7c132d9e22392e0aa9be

    SHA256

    e75a15101e74d4e2f823bef0a973ecbbc75bc05079a18490ef471826515760ce

    SHA512

    d31a81d1377b2b684e5cb58d5cc38da6e01771f90117af20abd8f5c7ec8a497317904f23474ec49c389758abe83ff89afc20cff4186b1fe2360ec960d58a3b6c

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    1020KB

    MD5

    b65d7344b0a7faa207d2e1a7adaafb60

    SHA1

    755ad15b1745b0e730d658d4a92e2b754425b7db

    SHA256

    f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92

    SHA512

    f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

  • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

    Filesize

    15KB

    MD5

    c9aaf1247944e0928d6a7eae35e8cdc4

    SHA1

    af91d57336d495bb220d8f72dcf59f34f5998fd3

    SHA256

    05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

    SHA512

    bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

  • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

    Filesize

    15KB

    MD5

    407d2d7dab36cdea871d4c6b9c62b258

    SHA1

    86cd158ad810c6772c22a5799c7acf4b9d7c9f57

    SHA256

    3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

    SHA512

    dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

  • C:\Program Files\Java\jre7\bin\jabswitch.cab

    Filesize

    54KB

    MD5

    e795eb03297dd66d2efac2c33920a69f

    SHA1

    bf41799164d6ab2690c39afa458122ed82f2d0a8

    SHA256

    133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

    SHA512

    6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

  • C:\Program Files\Java\jre7\bin\jabswitch.exe

    Filesize

    364KB

    MD5

    e66be1cb79bc7e290bc8e1f74e4766ed

    SHA1

    72c0de282c59c17a9abcafd460994fad9eaab354

    SHA256

    d707c7b236f714a35c38f4170e198dfc5ce9aec68242fc263e2d36a381e1fb12

    SHA512

    cdf052977153de83eda8f5e34737d380602cccbc3443e30637bc328afe3c21fc990b6b9136b7b7ecefefe226c87e007db63e583f17c795010922372264da5391

  • C:\Program Files\Java\jre7\bin\java-rmi.cab

    Filesize

    15KB

    MD5

    d3827115574d8b0ecbaeb03528c6d1a4

    SHA1

    2733607537ffc00e038039af7eba24601db6fbeb

    SHA256

    6ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f

    SHA512

    2a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18

  • C:\Program Files\Microsoft Games\Chess\Chess.cab

    Filesize

    3.0MB

    MD5

    07dd9dcd1cc2840751a1f8772f3c0195

    SHA1

    c6203a3990cfbf396ae87110e341f773cd6be4c1

    SHA256

    9b39147e1ba781ea8e463c22700f6ce354ac5e775e36657fd87bf41074835602

    SHA512

    5e547dc18a2b44a6dd67f6b43ee5b5b1bbd4ec1e8b5507b0d990837a7adb72b66808e7487f97062d54e4d3c2c7b791e3b580c9ed316e9d003849f7a6f6a3d56b

  • C:\Program Files\Microsoft Games\Chess\Chess.exe

    Filesize

    1.5MB

    MD5

    8861a7520b3151b73adde3c6e6fe11ee

    SHA1

    2c15b9cb5348d381c247e62a02d8a5744ca94f7c

    SHA256

    5df2783eece8569595bb150bbc1188dba369ae16adcd2b6f8ec28e4a6ccdf110

    SHA512

    0759ca498661048813463300a87dd647ccc7e26ce3e968f39f90ef6f7cd28bc64b547a4a3e039f2d657ac1d6180b6ae441c1cd3c49a61204454d7a4dd5c17379

  • C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE

    Filesize

    368KB

    MD5

    25e371d1eb7864af6f46950455afb214

    SHA1

    d1a9f95b0c7a034b5cf166c4ed3ccff8a7b55bd2

    SHA256

    b5b3c65effa69bb9953b12cd16bbce27fded992e06958e5a237528d7199eae08

    SHA512

    4fce2fa6935d4b398041d8e58757ae199a6897b79b2179f19b136b1e567959a2de79e113cdff137fd4f3d9babe7910ad6091b5d2edc778a8e2765d09feb571d8

  • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

    Filesize

    85KB

    MD5

    78e89dc545e6374c4e6c09c1d3ce0466

    SHA1

    bcbfe02e7fed041894db6404e60690d02301b763

    SHA256

    fabc7c12fd6523338f8adb3fefcaed7f213afe95e784ef36ecdf42da67421ab1

    SHA512

    6f4dbd49e79c5e540ea9b35e4acbcaf7c294781691ee4681580048aa75671d9d3f48c4d474ec834d9c193d2c597302554a6ce6c10651a4cc9d11db284b0884f8

  • C:\Program Files\Mozilla Firefox\crashreporter.cab

    Filesize

    262KB

    MD5

    73603c36b4d1522c3402d67ecf657312

    SHA1

    6a964ae5d681455c320ea0f8611b79a99a35b283

    SHA256

    7fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4

    SHA512

    5fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    697KB

    MD5

    3fa2910cbd44b17be47ff26ef27c5157

    SHA1

    d8a2bbcd3c88671b48478db293c61268fc24accf

    SHA256

    d448206c75c51f8a44a1c7fd5dabb8b0505f670ecb2e5d2adf55791b9cef1b0c

    SHA512

    16b70c679db2ba74a98f99956984fa044e96c821ccd5521b4882134c705b823674891d0521dc49c2391d5c184bbbd0c6d68890df65aad1972113aeda4f3b944a

  • C:\Program Files\Mozilla Firefox\default-browser-agent.exe

    Filesize

    265KB

    MD5

    7a91dfd90c8f843216d2e8e3d5597226

    SHA1

    2da9f998413171c633245acbde9609617101dd85

    SHA256

    115054104467b76a82901ede3fda6ef3d7396e331d32072c4d38ef3781568cd8

    SHA512

    beb2f0128fb38fab7165d7fc77bf9998f5abbcfa6cd7d036b51743ea0659052c249a6156e390ca6719d6ee98423d22307ed9546359b6b1fc94afbb587291d52f

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    1.2MB

    MD5

    d358e785b13cdb7846b3ec8b74c3ce43

    SHA1

    8581ec4bcd412733f64ed547b7b63bfec0caab7d

    SHA256

    3cdb1c6e5f4a607bc310b745d551b59eca0aac02cb83da146bedc52aa05a6beb

    SHA512

    451a4a6003d1ca1de98ea291537ca793621e4e23a75fa39e05320737bcd6bb4242d4fefa4c7458399fb54a5414635c3f67c8972377183b289fbb05aa13c91629

  • C:\Program Files\VideoLAN\VLC\uninstall.cab

    Filesize

    228KB

    MD5

    5ba8b6e3a9d08a4fd4f71eed8cc56275

    SHA1

    5bfd77c8ddbca1dd2d4e6a9e08a0d89b50a654d0

    SHA256

    e202657abb97ac953185c97f0d4e3d3133fe760d8b8c4e97a2c53d94bb8d58e2

    SHA512

    e8242d974ff4c103cc1af4d44e55070abca619dfbae0fe450fb2dbe165a0af629c5e010bc0cbc5d7a8d40a2c420aacb3857f4d410f65235da8099379458fe419

  • C:\Program Files\VideoLAN\VLC\uninstall.exe

    Filesize

    428KB

    MD5

    d18ff4cb78f077a5ff81763e6536a5ff

    SHA1

    69b9c97f901615873c4234678a3125992e4a7155

    SHA256

    c4edafb757e4334276b5b488e7a1346172ad586fdcdc0ca6c00f50b04e344b84

    SHA512

    8cfadc07cb0dc3c451066d9088fbd2d68d463b1b9fd36d78fa67058458427f964ace8f86b36558e90c56446ad3911a5bdb3b6508f47e3fbc7aa29635e5794e79

  • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab

    Filesize

    137KB

    MD5

    b2bf2621b184914d48bb147d38f64392

    SHA1

    b733404cf4231a069d47ca68b88118ddf05b18e0

    SHA256

    276c5e546732a7b5585670943c84fe4ea782a601ad54ad4248605ad4ee916210

    SHA512

    2966c8222af45c16c38a8341036ee58f65463d9874cc871639760b395cd8a3252e962b347e4b27c3aaf5735caeb5fc3154a29092d686642b66b49682662a168a

  • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe

    Filesize

    428KB

    MD5

    b18fd11e647272b7ef78dfee6d0447fd

    SHA1

    39bbb5e3f6f79183e54afdb7e545f8f56e812bb2

    SHA256

    2c266e2fb501e5b6c1acd1360f9919e0601151ca2f57bcf1a5ead5f7b243c7c0

    SHA512

    ba3e03f9bb3ecd78a4c3a0042db4d56b95f26286a4e5adb65a21d86a1f640b3cc085a26f3997f3ad9acb02ccfd434e8aaeab5fbaed07adca0588f4209770859e