Analysis
-
max time kernel
168s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 10:06
Static task
static1
Behavioral task
behavioral1
Sample
1556114ae5d666dbd078178d55b3f8aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1556114ae5d666dbd078178d55b3f8aa.exe
Resource
win10v2004-20231215-en
General
-
Target
1556114ae5d666dbd078178d55b3f8aa.exe
-
Size
141KB
-
MD5
1556114ae5d666dbd078178d55b3f8aa
-
SHA1
5dc91107785d80241ed750c8ca4c7474d2ba05bd
-
SHA256
40094f40c86eb060ed3d9530fb74b2b248a47a51ad7848223995cbaa0d1e13f2
-
SHA512
52126e6219f8ca5e44febaaf1e24a8258d5aa6559e40d95eddc53044c0695c8d6c66dc725ea11e317666a5e8ce0ceebd47ba99731d3755a2dd152dc6c285dc7a
-
SSDEEP
3072:W5yJGaBDcKFP/QCtxydMKNWUWFisaGJC:W59aBwC/QrAfaGw
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1556114ae5d666dbd078178d55b3f8aa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aa2f980860f54cdaa7498670a989f24aOneDriveSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1556114ae5d666dbd078178d55b3f8aa.exe" 1556114ae5d666dbd078178d55b3f8aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\OneDriveaa2f980860f54cdaa7498670a989f24a26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1556114ae5d666dbd078178d55b3f8aa.exe" 1556114ae5d666dbd078178d55b3f8aa.exe -
Drops file in System32 directory 1 IoCs
Processes:
1556114ae5d666dbd078178d55b3f8aa.exedescription ioc process File created C:\Windows\SysWOW64\ntdll.dll.dll 1556114ae5d666dbd078178d55b3f8aa.exe -
Drops file in Program Files directory 9 IoCs
Processes:
1556114ae5d666dbd078178d55b3f8aa.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAcrobat.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ToolsTools.exe 1556114ae5d666dbd078178d55b3f8aa.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ToolsTools.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\OfficeTools.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Componentsicudt60.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AdobeAcrobat2230.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Common Files\System\msadc\fr-FR\WindowsWindows.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\Systemmsdasqlr10.0.19041.1.exe 1556114ae5d666dbd078178d55b3f8aa.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\NPPDF32Acrobat.exe 1556114ae5d666dbd078178d55b3f8aa.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1556114ae5d666dbd078178d55b3f8aa.exepid process 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe 4536 1556114ae5d666dbd078178d55b3f8aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1556114ae5d666dbd078178d55b3f8aa.exe"C:\Users\Admin\AppData\Local\Temp\1556114ae5d666dbd078178d55b3f8aa.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\Systemmsdasqlr10.0.19041.1.exeFilesize
141KB
MD51556114ae5d666dbd078178d55b3f8aa
SHA15dc91107785d80241ed750c8ca4c7474d2ba05bd
SHA25640094f40c86eb060ed3d9530fb74b2b248a47a51ad7848223995cbaa0d1e13f2
SHA51252126e6219f8ca5e44febaaf1e24a8258d5aa6559e40d95eddc53044c0695c8d6c66dc725ea11e317666a5e8ce0ceebd47ba99731d3755a2dd152dc6c285dc7a
-
memory/4536-3-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4536-4-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4536-5-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB