Analysis
-
max time kernel
162s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a889f3e74bed692f498943e88cf9980_exe32_JC.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a889f3e74bed692f498943e88cf9980_exe32_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
1a889f3e74bed692f498943e88cf9980_exe32_JC.exe
-
Size
772KB
-
MD5
1a889f3e74bed692f498943e88cf9980
-
SHA1
46b859e0ef914eaeea93febae20272912f8e5153
-
SHA256
7400d5d07533c8850043c006348ff89d6df21b88f058554e6076741d374ad1d5
-
SHA512
08dc2725dda95d8c8aef31d2e2c9035e40311f266db90fc2db271d8b104cfa1575163abc39f6324c07b61a0a4c60373ce174ec30bc7aed86825d4a98810063b8
-
SSDEEP
24576:Vh0Jq1Yq3puOswtvoR4LHgZdJ8JV7HTDdA0+6q:VhoW+YAR4LHkJ8JV7P/q
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 952 9E82.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIDE.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\JitV.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp 9E82.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msoshext.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso20win32client.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\nppdf32.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\adal.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\PPSLAX.DLL 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 9E82.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx 9E82.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ONNXRuntime-0.5.X.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 9E82.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso30win32client.dll 9E82.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll 9E82.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 9E82.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2488 wrote to memory of 952 2488 1a889f3e74bed692f498943e88cf9980_exe32_JC.exe 83 PID 2488 wrote to memory of 952 2488 1a889f3e74bed692f498943e88cf9980_exe32_JC.exe 83 PID 2488 wrote to memory of 952 2488 1a889f3e74bed692f498943e88cf9980_exe32_JC.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a889f3e74bed692f498943e88cf9980_exe32_JC.exe"C:\Users\Admin\AppData\Local\Temp\1a889f3e74bed692f498943e88cf9980_exe32_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmpC:\Users\Admin\AppData\Local\Temp\9E82.tmp2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666