Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 07:37

General

  • Target

    7a1a47d385bb62482f5e1a627d2d3954.exe

  • Size

    274KB

  • MD5

    7a1a47d385bb62482f5e1a627d2d3954

  • SHA1

    122cd4db378afabe455034fa0a3df47e126b3517

  • SHA256

    4250d5606f6c6930e11927880cfc305d69b6573236ab97698a5f21a7fc23b683

  • SHA512

    b4bdc721b3f324e0c57819d954aecc645785f0aa6fadc624869de9627758387d9067a39a2081378bf7bc084ca7a5ddee1f3692a020a4b3ca42f715b0f8a695f9

  • SSDEEP

    3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBF91gP:L1XlKgzelZNQSBQGH/CSpWqTImQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a1a47d385bb62482f5e1a627d2d3954.exe
    "C:\Users\Admin\AppData\Local\Temp\7a1a47d385bb62482f5e1a627d2d3954.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:2932

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.cab

          Filesize

          458KB

          MD5

          619f7135621b50fd1900ff24aade1524

          SHA1

          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

          SHA256

          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

          SHA512

          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        • C:\Program Files\7-Zip\7zFM.cab

          Filesize

          399KB

          MD5

          8ff3b8fd4e2e0cbaced988c229776344

          SHA1

          672dcc081c4fe733fe973cf92ffe72f4ba3d186d

          SHA256

          61e967c45233db33e0b44e0540e8b096c7f3d7eff40f22d2c107e6e69bcdc6b2

          SHA512

          5eaff3165d4d76028eb2cb16c6e1895fdb60ec51e098922114d9ee38f089e0d9c04d7075f31dd479d251792c089b097bc4ce16f529363c3e4acd410e60d5e1ab

        • C:\Program Files\7-Zip\RCXFC49.tmp

          Filesize

          236KB

          MD5

          0d8626ee0ae4d13506e3d53ec0382a54

          SHA1

          d4b055a326e93ed47934bdcbd11eb7850e691411

          SHA256

          777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693

          SHA512

          20c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a

        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

          Filesize

          236KB

          MD5

          12946bb53d65bcf7efb55098a1645caa

          SHA1

          2e4f07fe50b7dbe77811b2b6095cba6114397a63

          SHA256

          6aceb0b7b5dccd3f0f6e391ecdd17e3ee8a3ce8dfaac11b62c3e7f530c0d3329

          SHA512

          de2149b4de624c73777aaa36c1bf1a0cbefbedd68ac5a6560ac8b3f077bc65e235847e8647ce527a225fe715b131cec3437641e0bdc5a3dd95f277bf47a4f7f5

        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

          Filesize

          118KB

          MD5

          f45a7db6aec433fd579774dfdb3eaa89

          SHA1

          2f8773cc2b720143776a0909d19b98c4954b39cc

          SHA256

          2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

          SHA512

          03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

          Filesize

          136KB

          MD5

          7763b5ce5715ff5beee2c67c613f4e26

          SHA1

          94a018f73755ecff5dfa90928ba42dfb0c723787

          SHA256

          9675cc8e8a5a3611fc8c51a72bc07310d23f60af14e8ae3a89712652d9222162

          SHA512

          b749ae680fda201519c1e1c84b9c0cd7819d2f6d9c564315c8d0b20ad41fd361498c05a94bb25cf7c667c56f49149b808f68de264f58b8e504648524d2901dc7

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

          Filesize

          162KB

          MD5

          d50f3f3dc5eec41e2b98941fa00b1264

          SHA1

          01ee71ece440a16e58cab4b1e627f4ddd930c947

          SHA256

          ec39f474e02362e2765df5c577ab4d8c7d98cf32a7ce305e61ae41253019e2a9

          SHA512

          be165893e60bde79e703e8d5f1d1238378c26ac19dac87d03a24defe66b8b5f4e2a8419c0a26b72dfaece6b3be81fe6613b2f410aa41415d8acbc20968adcf29

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

          Filesize

          87KB

          MD5

          0173a7e4e50ac5b4bfbb2c84d06a46ab

          SHA1

          00de5a7823c22f844482f59804f7a0515c8a9bc6

          SHA256

          c59aeb886e53b381c6c9f47da478b3313985ffc53e7772410b080b24a617f0a3

          SHA512

          c4310c377cf7c2823c794af04a02eaa69e7128b01df20f24a88026276cdc870f5dbbc2a681a54aebd3f9cbf5c7d585fcbe909e86f7bbab8765114c2d6f6b1ea5

        • C:\Program Files\Google\Chrome\Application\RCXFCF2.tmp

          Filesize

          157KB

          MD5

          1bf60dbe98e9dbb3073d5fbeaa3c5079

          SHA1

          5e2ff4054aa8620a11680c899c753e35c84d90ea

          SHA256

          0507bef206db5f815062c717c9ba89870aa9fcd5c3113825904e29cab8315289

          SHA512

          090a8aed93932436fb78bc9ae74d3eb87c31ee1978c93a2262a04db61bdaf906e328bfde580db5b004c1ea0a0a1f2cb6efb52328f5c09af87a1ba92de6bf91f9

        • C:\Program Files\Google\Chrome\Application\chrome.cab

          Filesize

          136KB

          MD5

          a4e3f54a92632ba353c44d2bef4762a5

          SHA1

          a8b7c230678767874ef1e81befe171b7ee41e1bb

          SHA256

          a1b6ed6d5e6788b6878c8588976dbb48c280cfb8d607fb82493698bfce3fdde0

          SHA512

          07a4f8947396efca8bbb91e838d679df453b665bf69d39445aab61c860d3d6539586b02c36ffb09a8f4f622515fb98cd784cb0dabea6861952d257491a8cdf19

        • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

          Filesize

          250KB

          MD5

          210c2ec2af48dc78dc9f15fcf2b74a3f

          SHA1

          0f62e9f69e265618f328c518153550e11c2cda50

          SHA256

          fe5b3cb7e84a57b9026a76ea1bad5f5c1f114435ce2108a2a5b9e416ea3e8039

          SHA512

          997e105bcb8fb57b1b3e79f1b7a092c77a5d8bbc4ca243043517cc0da22d9d7df5e674d0436015bf5c97aa850b0d8c1ca439e96e407fae0236c1268bdd98807d

        • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

          Filesize

          15KB

          MD5

          c9aaf1247944e0928d6a7eae35e8cdc4

          SHA1

          af91d57336d495bb220d8f72dcf59f34f5998fd3

          SHA256

          05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

          SHA512

          bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

        • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

          Filesize

          15KB

          MD5

          407d2d7dab36cdea871d4c6b9c62b258

          SHA1

          86cd158ad810c6772c22a5799c7acf4b9d7c9f57

          SHA256

          3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

          SHA512

          dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

        • C:\Program Files\Java\jre7\bin\jabswitch.cab

          Filesize

          54KB

          MD5

          e795eb03297dd66d2efac2c33920a69f

          SHA1

          bf41799164d6ab2690c39afa458122ed82f2d0a8

          SHA256

          133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

          SHA512

          6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

        • C:\Program Files\Java\jre7\bin\java-rmi.cab

          Filesize

          15KB

          MD5

          d3827115574d8b0ecbaeb03528c6d1a4

          SHA1

          2733607537ffc00e038039af7eba24601db6fbeb

          SHA256

          6ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f

          SHA512

          2a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18

        • C:\Program Files\Microsoft Games\Chess\Chess.cab

          Filesize

          170KB

          MD5

          3d411384b2c6c9104508555b52de17da

          SHA1

          f571dbffb8a3a6b15d2ff6dfc0fbb1b323879e9d

          SHA256

          cb4e0dfcdf8b7322c7626b2aaa2b735c582f08e9bc32784034f452109912dea3

          SHA512

          ac41e71453c884838c5d23eef5f3b0f9f10c0b9dff9cc3f17c5e899e48640f5c7eee205635b21b6c45eb75c1e5326e10741ebd16646078625e29e21122ff9e22

        • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

          Filesize

          63KB

          MD5

          afd4edad64dccf75294d66f4d6a73757

          SHA1

          b5d4e016938d1233c2cc9ecf94fc58dc2f498903

          SHA256

          49e82a8ab525e5a6300adeb8852947c1f8319b1d3cdb3d3dd596a88fb7506521

          SHA512

          2871a138c76cd9756cc96eae12ce6b624088ee326a5c43df3ac587c9f4f1c498495a03e21d1c7da1546ee662426a2c30e4ef31ab4a8d374687eec5eab8c2f3d1

        • C:\Program Files\Mozilla Firefox\crashreporter.cab

          Filesize

          105KB

          MD5

          50b3ae3df0380906a2336d7d9ba69709

          SHA1

          d1422997930eb4a1456f2f71d8adce5a159d378f

          SHA256

          5e1951b72ee3906d6d0206f6163cb643de1d9fc25caaa87af4fc40b8d6b2070e

          SHA512

          4fe23730f41b2b5cc09254d08dd018353c4702a172a07bd0362be47964962460c5a55ee90c28d4cffe53fe856536be107d0e417abe157f39c770c0435a6dc560

        • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

          Filesize

          326KB

          MD5

          fab1c86eb4abc592e68d6e4520f5ec29

          SHA1

          a0b63a8ecbb5d507ea6679a1c8a4687e350c09bb

          SHA256

          6d47e621d34448e1c9759d64fb6c041e189ad7b1d47e5e16f630e177157a0f6e

          SHA512

          4600f49546be2f3247ffdca069360f36bd1d7f2f0becd523afaf5632002c5b1439f8965e89fc42c7871584b531fc620b74e4118f890acdb06ecea1d743ffcfb6

        • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

          Filesize

          75KB

          MD5

          078d1e36de629824a18d813321b36a1f

          SHA1

          4f14c85181c602a365900ec980244a28bbc5afda

          SHA256

          9e78a63a3b85f673a5dace34452882bdbae8d339b791370bfcd73a147fb1b622

          SHA512

          ee1b6b6fe287a9157934237005b9729b4f9caa6ab70ee98c818be476790bd4b9b0c9b28844e23733ecbc97185f8a7d3c73a93f757a33070959e5adebc379ba69

        • C:\Program Files\Mozilla Firefox\uninstall\helper.exe

          Filesize

          120KB

          MD5

          983e1189d3a640630000c86d78f1a676

          SHA1

          6633f226d5d281ec427a2c40d7010172d1755741

          SHA256

          f290a5e53160d942b505b36daf569647888baa8ed1718c52dbf169948f681bb9

          SHA512

          e9885d4982db00d0e518a512948070d4f9119c4672783d6d4aeb0826f0b424bb3ccacffccbbff66f15db164818c9ef322af97c33088225b2f0591a5b51d3b351

        • C:\Program Files\VideoLAN\VLC\uninstall.cab

          Filesize

          22KB

          MD5

          5fe20bb647a4d0e838acc01031b60a96

          SHA1

          2c3c94506b88d8057b3a42be12005cf75f024675

          SHA256

          e8dba7f10ab8c433296ffd3cbb64331f9965693b1c157b68fea87402f5a617ab

          SHA512

          290e81dfcff608a00af5f52108d2970d369ab7ad45cfc72937f6ae7ef44f3981f5c9b2b2f8e447dcdaefc15df0070c288bac918fa327113eecbb385ce3b880de

        • C:\Program Files\VideoLAN\VLC\uninstall.exe

          Filesize

          154KB

          MD5

          8ea7ea954d03febccf5213ae19af1ca0

          SHA1

          73ebe0c67b42364d919bdecfce960c3f57edd55b

          SHA256

          ef5330f2c92cecf1fbfaa4c0879da6f035ed1e9558b085cb5f3cfbea3b93e77f

          SHA512

          bb1c2d493902651d5ff443da55c605512afcea0b42a479f0005f3cb2f1a0f19bfd7ff540930846b1255dc27e29769edb11715259c4fa587909b7ced6433ff249

        • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab

          Filesize

          45KB

          MD5

          f2aa311e3f41797c90fa9d7de9c6f838

          SHA1

          8d0ec8e4898dd707738d895d042f7cba37981bac

          SHA256

          3ed9531c8e07ac660b0153aaf10b8230dd9293ba5aaba064bbc4b6e5f481aeb0

          SHA512

          b8a1e459ad6bf943e4d9b1adb76ecf0884a4e480aa210378e02930c1d9f8f8e34a8a2db932751611f0196e06ab8a905a8da7334bc7406922462cdf1db8d3cadf