Analysis
-
max time kernel
17s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
144dec8962a519049a8e860040ff8c83.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
144dec8962a519049a8e860040ff8c83.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
144dec8962a519049a8e860040ff8c83.exe
-
Size
250KB
-
MD5
144dec8962a519049a8e860040ff8c83
-
SHA1
2fb0f8c7fe8e27f20bae99c5b35fb8641f865fcb
-
SHA256
58f73ca7b211babf9f79299ba4e518eebe46651022da7409f42dd9ae09287215
-
SHA512
43b39d95cb290bf7b4bd74d15037fca71ea39e632d802af7a3e469a70bdcf8fe9cda2a712043c6e73ab906b6224d113552dc6ff41e16f1fb4a5d82cc2f7b2532
-
SSDEEP
3072:MEsmiEsmiEsmiEsmiEsmiEsmiEsmiEsmiEsml+W2YL:MZ/Z/Z/Z/Z/Z/Z/Z/Z4+W2YL
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2792 exc.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\cipher.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\accessibilitycpl.dll exc.exe File created C:\WINDOWS\SysWOW64\ACCTRES.dll exc.exe File created C:\WINDOWS\SysWOW64\AdapterTroubleshooter.exe exc.exe File created C:\WINDOWS\SysWOW64\asycfilt.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\browcli.dll exc.exe File created C:\WINDOWS\SysWOW64\capisp.dll exc.exe File created C:\WINDOWS\SysWOW64\CHxReadingStringIME.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\clbcatq.dll exc.exe File created C:\WINDOWS\SysWOW64\acledit.dll exc.exe File created C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\chkntfs.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\clfsw32.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\connect.dll exc.exe File created C:\WINDOWS\SysWOW64\12520850.cpx 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\SysWOW64\aspnet_counters.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\avifil32.dll exc.exe File created C:\WINDOWS\SysWOW64\bidispl.dll exc.exe File created C:\WINDOWS\SysWOW64\Apphlpdm.dll exc.exe File created C:\WINDOWS\SysWOW64\authz.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\azroleui.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cmifw.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cmutil.dll exc.exe File created C:\WINDOWS\SysWOW64\azroles.dll exc.exe File created C:\WINDOWS\SysWOW64\cdosys.dll exc.exe File created C:\WINDOWS\SysWOW64\credwiz.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\ActionCenter.dll exc.exe File created C:\WINDOWS\SysWOW64\adsldpc.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll exc.exe File created C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll exc.exe File created C:\WINDOWS\SysWOW64\avicap32.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cabview.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\12520850.cpx exc.exe File created C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\atl.dll exc.exe File created C:\WINDOWS\SysWOW64\autoplay.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\avrt.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\bitsprx4.dll exc.exe File created C:\WINDOWS\SysWOW64\apds.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\auditpolmsg.dll exc.exe File created C:\WINDOWS\SysWOW64\AuthFWWizFwk.dll exc.exe File created C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cngaudit.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\convert.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cscdll.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\apss.dll exc.exe File created C:\WINDOWS\SysWOW64\bopomofo.uce exc.exe File created C:\WINDOWS\SysWOW64\BWUnpairElevated.dll exc.exe File created C:\WINDOWS\SysWOW64\cfgbkend.dll exc.exe File created C:\WINDOWS\SysWOW64\colorcpl.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cryptxml.dll exc.exe File created C:\WINDOWS\SysWOW64\cryptdll.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\adtschema.dll exc.exe File created C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll exc.exe File created C:\WINDOWS\SysWOW64\bcrypt.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\cmstp.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\credwiz.exe exc.exe File created C:\WINDOWS\SysWOW64\api-ms-win-core-localization-l1-2-0.dll exc.exe File created C:\WINDOWS\SysWOW64\bitsadmin.exe exc.exe File created C:\WINDOWS\SysWOW64\CertPolEng.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\apircl.dll exc.exe File created C:\WINDOWS\SysWOW64\AuthFWGP.dll 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\SysWOW64\BioCredProv.dll exc.exe -
Drops file in Windows directory 52 IoCs
description ioc Process File created C:\WINDOWS\splwow64.exe exc.exe File opened for modification C:\WINDOWS\Starter.xml 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\twunk_16.exe 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\PFRO.log 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\twunk_32.exe exc.exe File opened for modification C:\WINDOWS\WindowsUpdate.log exc.exe File opened for modification C:\WINDOWS\TSSysprep.log 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\hh.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\twain_32.dll 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\Ultimate.xml exc.exe File opened for modification C:\WINDOWS\win.ini exc.exe File created C:\WINDOWS\splwow64.exe 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\system.ini exc.exe File opened for modification C:\WINDOWS\win.ini 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\bfsvc.exe exc.exe File opened for modification C:\WINDOWS\Starter.xml exc.exe File opened for modification C:\WINDOWS\Ultimate.xml 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\write.exe exc.exe File created C:\WINDOWS\explorer.exe 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\WindowsUpdate.log 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\mib.bin 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\explorer.exe exc.exe File created C:\WINDOWS\twain_32.dll exc.exe File created C:\WINDOWS\winhlp32.exe exc.exe File created C:\WINDOWS\fveupdate.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\twunk_32.exe 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\setuperr.log exc.exe File created C:\WINDOWS\HelpPane.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\mib.bin exc.exe File opened for modification C:\WINDOWS\TSSysprep.log exc.exe File created C:\WINDOWS\twain.dll exc.exe File created C:\WINDOWS\twunk_16.exe exc.exe File created C:\WINDOWS\WMSysPr9.prx 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\DtcInstall.log 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\HelpPane.exe exc.exe File opened for modification C:\WINDOWS\setupact.log exc.exe File opened for modification C:\WINDOWS\setuperr.log 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\system.ini 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\write.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\fveupdate.exe exc.exe File opened for modification C:\WINDOWS\msdfmap.ini exc.exe File created C:\WINDOWS\notepad.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\winhlp32.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\bfsvc.exe 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\hh.exe exc.exe File opened for modification C:\WINDOWS\setupact.log 144dec8962a519049a8e860040ff8c83.exe File created C:\WINDOWS\WMSysPr9.prx exc.exe File opened for modification C:\WINDOWS\DtcInstall.log exc.exe File created C:\WINDOWS\notepad.exe exc.exe File opened for modification C:\WINDOWS\PFRO.log exc.exe File created C:\WINDOWS\twain.dll 144dec8962a519049a8e860040ff8c83.exe File opened for modification C:\WINDOWS\msdfmap.ini 144dec8962a519049a8e860040ff8c83.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2792 2108 144dec8962a519049a8e860040ff8c83.exe 17 PID 2108 wrote to memory of 2792 2108 144dec8962a519049a8e860040ff8c83.exe 17 PID 2108 wrote to memory of 2792 2108 144dec8962a519049a8e860040ff8c83.exe 17 PID 2108 wrote to memory of 2792 2108 144dec8962a519049a8e860040ff8c83.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\144dec8962a519049a8e860040ff8c83.exe"C:\Users\Admin\AppData\Local\Temp\144dec8962a519049a8e860040ff8c83.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\exc.exe"C:\exc.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2792 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.freeav.com/3⤵PID:2268
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:24⤵PID:2084
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.freeav.com/2⤵PID:2940
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:23⤵PID:3036
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:1061899 /prefetch:23⤵PID:1576
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:734226 /prefetch:23⤵PID:756
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵PID:3012