Analysis
-
max time kernel
189s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 06:19
Behavioral task
behavioral1
Sample
2da64bf86bf6e0b2d7833b26322a6c63_JC.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2da64bf86bf6e0b2d7833b26322a6c63_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2da64bf86bf6e0b2d7833b26322a6c63_JC.exe
-
Size
4.6MB
-
MD5
2da64bf86bf6e0b2d7833b26322a6c63
-
SHA1
eca01c227bbb14d31191f326c7df08bd16287696
-
SHA256
501453ec3e9932580f7e68a161f1cc4f324a3cc0d89b2fecdf848b9e209de82c
-
SHA512
b51ecae5a92c416b570ded0683fd08eeee00181eb6e4b724e216c2d57ef52186f4a243210b68bda01b555fd5844b7b721e8bb7eb31d880eddeeaa9fbea7ff3b4
-
SSDEEP
98304:zxYOXwnS4rV6wV2VhYs+wE9XD8VBQj2jIfkZc:aIQV2VqV9z8IXP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x001300000000b526-9.dat aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jre7\bin\javaw.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe$ 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2996 2da64bf86bf6e0b2d7833b26322a6c63_JC.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD52da64bf86bf6e0b2d7833b26322a6c63
SHA1eca01c227bbb14d31191f326c7df08bd16287696
SHA256501453ec3e9932580f7e68a161f1cc4f324a3cc0d89b2fecdf848b9e209de82c
SHA512b51ecae5a92c416b570ded0683fd08eeee00181eb6e4b724e216c2d57ef52186f4a243210b68bda01b555fd5844b7b721e8bb7eb31d880eddeeaa9fbea7ff3b4