Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
7a1a47d385bb62482f5e1a627d2d3954.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7a1a47d385bb62482f5e1a627d2d3954.exe
Resource
win10v2004-20231215-en
General
-
Target
7a1a47d385bb62482f5e1a627d2d3954.exe
-
Size
274KB
-
MD5
7a1a47d385bb62482f5e1a627d2d3954
-
SHA1
122cd4db378afabe455034fa0a3df47e126b3517
-
SHA256
4250d5606f6c6930e11927880cfc305d69b6573236ab97698a5f21a7fc23b683
-
SHA512
b4bdc721b3f324e0c57819d954aecc645785f0aa6fadc624869de9627758387d9067a39a2081378bf7bc084ca7a5ddee1f3692a020a4b3ca42f715b0f8a695f9
-
SSDEEP
3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBF91gP:L1XlKgzelZNQSBQGH/CSpWqTImQ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\G: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\H: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\M: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\K: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\L: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\N: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\E: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\I: 7a1a47d385bb62482f5e1a627d2d3954.exe File opened (read-only) \??\J: 7a1a47d385bb62482f5e1a627d2d3954.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCXFCF5.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\DVD Maker\DVDMaker.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Journal\Journal.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Microsoft Games\Chess\Chess.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFE31.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFCE1.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXFD1B.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXFD72.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Media Player\WMPDMC.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows NT\Accessories\wordpad.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFCF8.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Journal\PDIALOG.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFD0A.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXFE52.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Mail\WinMail.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXFD42.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RCXFE0C.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXFE96.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Media Player\wmpenc.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Media Player\wmpenc.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\7-Zip\7z.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Mail\wabmig.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Media Player\wmpshare.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFE1F.tmp 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Defender\MpCmdRun.cab 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Windows Journal\Journal.exe 7a1a47d385bb62482f5e1a627d2d3954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab 7a1a47d385bb62482f5e1a627d2d3954.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
399KB
MD58ff3b8fd4e2e0cbaced988c229776344
SHA1672dcc081c4fe733fe973cf92ffe72f4ba3d186d
SHA25661e967c45233db33e0b44e0540e8b096c7f3d7eff40f22d2c107e6e69bcdc6b2
SHA5125eaff3165d4d76028eb2cb16c6e1895fdb60ec51e098922114d9ee38f089e0d9c04d7075f31dd479d251792c089b097bc4ce16f529363c3e4acd410e60d5e1ab
-
Filesize
236KB
MD50d8626ee0ae4d13506e3d53ec0382a54
SHA1d4b055a326e93ed47934bdcbd11eb7850e691411
SHA256777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693
SHA51220c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a
-
Filesize
236KB
MD512946bb53d65bcf7efb55098a1645caa
SHA12e4f07fe50b7dbe77811b2b6095cba6114397a63
SHA2566aceb0b7b5dccd3f0f6e391ecdd17e3ee8a3ce8dfaac11b62c3e7f530c0d3329
SHA512de2149b4de624c73777aaa36c1bf1a0cbefbedd68ac5a6560ac8b3f077bc65e235847e8647ce527a225fe715b131cec3437641e0bdc5a3dd95f277bf47a4f7f5
-
Filesize
118KB
MD5f45a7db6aec433fd579774dfdb3eaa89
SHA12f8773cc2b720143776a0909d19b98c4954b39cc
SHA2562bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA51203a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662
-
Filesize
136KB
MD57763b5ce5715ff5beee2c67c613f4e26
SHA194a018f73755ecff5dfa90928ba42dfb0c723787
SHA2569675cc8e8a5a3611fc8c51a72bc07310d23f60af14e8ae3a89712652d9222162
SHA512b749ae680fda201519c1e1c84b9c0cd7819d2f6d9c564315c8d0b20ad41fd361498c05a94bb25cf7c667c56f49149b808f68de264f58b8e504648524d2901dc7
-
Filesize
162KB
MD5d50f3f3dc5eec41e2b98941fa00b1264
SHA101ee71ece440a16e58cab4b1e627f4ddd930c947
SHA256ec39f474e02362e2765df5c577ab4d8c7d98cf32a7ce305e61ae41253019e2a9
SHA512be165893e60bde79e703e8d5f1d1238378c26ac19dac87d03a24defe66b8b5f4e2a8419c0a26b72dfaece6b3be81fe6613b2f410aa41415d8acbc20968adcf29
-
Filesize
87KB
MD50173a7e4e50ac5b4bfbb2c84d06a46ab
SHA100de5a7823c22f844482f59804f7a0515c8a9bc6
SHA256c59aeb886e53b381c6c9f47da478b3313985ffc53e7772410b080b24a617f0a3
SHA512c4310c377cf7c2823c794af04a02eaa69e7128b01df20f24a88026276cdc870f5dbbc2a681a54aebd3f9cbf5c7d585fcbe909e86f7bbab8765114c2d6f6b1ea5
-
Filesize
157KB
MD51bf60dbe98e9dbb3073d5fbeaa3c5079
SHA15e2ff4054aa8620a11680c899c753e35c84d90ea
SHA2560507bef206db5f815062c717c9ba89870aa9fcd5c3113825904e29cab8315289
SHA512090a8aed93932436fb78bc9ae74d3eb87c31ee1978c93a2262a04db61bdaf906e328bfde580db5b004c1ea0a0a1f2cb6efb52328f5c09af87a1ba92de6bf91f9
-
Filesize
136KB
MD5a4e3f54a92632ba353c44d2bef4762a5
SHA1a8b7c230678767874ef1e81befe171b7ee41e1bb
SHA256a1b6ed6d5e6788b6878c8588976dbb48c280cfb8d607fb82493698bfce3fdde0
SHA51207a4f8947396efca8bbb91e838d679df453b665bf69d39445aab61c860d3d6539586b02c36ffb09a8f4f622515fb98cd784cb0dabea6861952d257491a8cdf19
-
Filesize
250KB
MD5210c2ec2af48dc78dc9f15fcf2b74a3f
SHA10f62e9f69e265618f328c518153550e11c2cda50
SHA256fe5b3cb7e84a57b9026a76ea1bad5f5c1f114435ce2108a2a5b9e416ea3e8039
SHA512997e105bcb8fb57b1b3e79f1b7a092c77a5d8bbc4ca243043517cc0da22d9d7df5e674d0436015bf5c97aa850b0d8c1ca439e96e407fae0236c1268bdd98807d
-
Filesize
15KB
MD5c9aaf1247944e0928d6a7eae35e8cdc4
SHA1af91d57336d495bb220d8f72dcf59f34f5998fd3
SHA25605b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b
SHA512bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51
-
Filesize
15KB
MD5407d2d7dab36cdea871d4c6b9c62b258
SHA186cd158ad810c6772c22a5799c7acf4b9d7c9f57
SHA2563c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9
SHA512dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17
-
Filesize
54KB
MD5e795eb03297dd66d2efac2c33920a69f
SHA1bf41799164d6ab2690c39afa458122ed82f2d0a8
SHA256133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1
SHA5126a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef
-
Filesize
15KB
MD5d3827115574d8b0ecbaeb03528c6d1a4
SHA12733607537ffc00e038039af7eba24601db6fbeb
SHA2566ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f
SHA5122a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18
-
Filesize
170KB
MD53d411384b2c6c9104508555b52de17da
SHA1f571dbffb8a3a6b15d2ff6dfc0fbb1b323879e9d
SHA256cb4e0dfcdf8b7322c7626b2aaa2b735c582f08e9bc32784034f452109912dea3
SHA512ac41e71453c884838c5d23eef5f3b0f9f10c0b9dff9cc3f17c5e899e48640f5c7eee205635b21b6c45eb75c1e5326e10741ebd16646078625e29e21122ff9e22
-
Filesize
63KB
MD5afd4edad64dccf75294d66f4d6a73757
SHA1b5d4e016938d1233c2cc9ecf94fc58dc2f498903
SHA25649e82a8ab525e5a6300adeb8852947c1f8319b1d3cdb3d3dd596a88fb7506521
SHA5122871a138c76cd9756cc96eae12ce6b624088ee326a5c43df3ac587c9f4f1c498495a03e21d1c7da1546ee662426a2c30e4ef31ab4a8d374687eec5eab8c2f3d1
-
Filesize
105KB
MD550b3ae3df0380906a2336d7d9ba69709
SHA1d1422997930eb4a1456f2f71d8adce5a159d378f
SHA2565e1951b72ee3906d6d0206f6163cb643de1d9fc25caaa87af4fc40b8d6b2070e
SHA5124fe23730f41b2b5cc09254d08dd018353c4702a172a07bd0362be47964962460c5a55ee90c28d4cffe53fe856536be107d0e417abe157f39c770c0435a6dc560
-
Filesize
326KB
MD5fab1c86eb4abc592e68d6e4520f5ec29
SHA1a0b63a8ecbb5d507ea6679a1c8a4687e350c09bb
SHA2566d47e621d34448e1c9759d64fb6c041e189ad7b1d47e5e16f630e177157a0f6e
SHA5124600f49546be2f3247ffdca069360f36bd1d7f2f0becd523afaf5632002c5b1439f8965e89fc42c7871584b531fc620b74e4118f890acdb06ecea1d743ffcfb6
-
Filesize
75KB
MD5078d1e36de629824a18d813321b36a1f
SHA14f14c85181c602a365900ec980244a28bbc5afda
SHA2569e78a63a3b85f673a5dace34452882bdbae8d339b791370bfcd73a147fb1b622
SHA512ee1b6b6fe287a9157934237005b9729b4f9caa6ab70ee98c818be476790bd4b9b0c9b28844e23733ecbc97185f8a7d3c73a93f757a33070959e5adebc379ba69
-
Filesize
120KB
MD5983e1189d3a640630000c86d78f1a676
SHA16633f226d5d281ec427a2c40d7010172d1755741
SHA256f290a5e53160d942b505b36daf569647888baa8ed1718c52dbf169948f681bb9
SHA512e9885d4982db00d0e518a512948070d4f9119c4672783d6d4aeb0826f0b424bb3ccacffccbbff66f15db164818c9ef322af97c33088225b2f0591a5b51d3b351
-
Filesize
22KB
MD55fe20bb647a4d0e838acc01031b60a96
SHA12c3c94506b88d8057b3a42be12005cf75f024675
SHA256e8dba7f10ab8c433296ffd3cbb64331f9965693b1c157b68fea87402f5a617ab
SHA512290e81dfcff608a00af5f52108d2970d369ab7ad45cfc72937f6ae7ef44f3981f5c9b2b2f8e447dcdaefc15df0070c288bac918fa327113eecbb385ce3b880de
-
Filesize
154KB
MD58ea7ea954d03febccf5213ae19af1ca0
SHA173ebe0c67b42364d919bdecfce960c3f57edd55b
SHA256ef5330f2c92cecf1fbfaa4c0879da6f035ed1e9558b085cb5f3cfbea3b93e77f
SHA512bb1c2d493902651d5ff443da55c605512afcea0b42a479f0005f3cb2f1a0f19bfd7ff540930846b1255dc27e29769edb11715259c4fa587909b7ced6433ff249
-
Filesize
45KB
MD5f2aa311e3f41797c90fa9d7de9c6f838
SHA18d0ec8e4898dd707738d895d042f7cba37981bac
SHA2563ed9531c8e07ac660b0153aaf10b8230dd9293ba5aaba064bbc4b6e5f481aeb0
SHA512b8a1e459ad6bf943e4d9b1adb76ecf0884a4e480aa210378e02930c1d9f8f8e34a8a2db932751611f0196e06ab8a905a8da7334bc7406922462cdf1db8d3cadf