6fa28dee8ab219054d3fd6bb80c3cb720c705498e49eac98eecc3c41405cc3ea

Analysis

max time kernel
162s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2332223da5df70d3aca429110788a845.exe
Size

710KB
MD5

2332223da5df70d3aca429110788a845
SHA1

bc4209d87e86d075b0b924028d2c11f9a76dc5ef
SHA256

6fa28dee8ab219054d3fd6bb80c3cb720c705498e49eac98eecc3c41405cc3ea
SHA512

b01d72c81f61cb2c17583d5af4d60479f6cdf5f27e9aec6ad3f2f44038c7aea487bd4b4b502379a2069b94152b11e055a4340a7ae6bd7811d301996a9c3f2294
SSDEEP

12288:za3XiuigTQYphbR3ndDGpJJpVAGOJXkUo+bJtWXghaPo1XE/YaFBatBbqfnQes:zanHn8qh9MpRVKJXkU9bDNbwgBenO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2000	svchost.exe
2676	2332223da5df70d3aca429110788a845.exe
2856	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	svchost.exe

Drops file in Program Files directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2332223da5df70d3aca429110788a845.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2000	752	2332223da5df70d3aca429110788a845.exe	27
PID 752 wrote to memory of 2000	752	2332223da5df70d3aca429110788a845.exe	27
PID 752 wrote to memory of 2000	752	2332223da5df70d3aca429110788a845.exe	27
PID 752 wrote to memory of 2000	752	2332223da5df70d3aca429110788a845.exe	27
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28
PID 2000 wrote to memory of 2676	2000	svchost.exe	28

C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe
"C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe
    "C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe"
    3⤵
    - Executes dropped EXE
    PID:2676

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe

Filesize
64KB

MD5
25428c93c005ca71ed06dc760af2e2ad

SHA1
2e92004b12d19056955227d87c309dde6f0c2f22

SHA256
532e29b5b76ca90c9cc8ef826e4c7d6818b8a89d3b7fab8762425bc476103bd5

SHA512
da098f98be0bb1fe068d78beae801a05e0b64a5eb03f8c9b3f6228ff1b15fed9ef1597afd4ff10faee28bd4052ca4849f40ec97690a2aee0fcb85d9ef337c76b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe

Filesize
675KB

MD5
d6089e10f30111c4c14af916edfe648f

SHA1
64d89a3fc3fbb8daeaf20eb0455b49ddcac094e5

SHA256
c88dc3a5952723397224814eaef3a8a4603034ddc21269dfe6d0d9be016dff8b

SHA512
1fde6b4aa4f054809da51f28d9b1d42b791703b47212d1a499322e66960deb114dd487b373d8150720543581bb281c287ea51d3549753eb3aa6ab8f88bcedd33

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
8ad0c91179cc96cf5c96007f46717eb7

SHA1
367a87ac57ddc558ca35f9161e3c13ae4971d658

SHA256
528cd37789ed96d2c2a5008db280a769ea6a72afe15a322039cc444203c60084

SHA512
49802da8f61dacb8d9c20d3f4f6a81e8d35b3cc0365a83b8f8bfc753a50459e70da86b61a21308715d0e552cdc6d97f4b9e7fc6bc8c5b5210ced74d6b995ad82

Download Submit
\Users\Admin\AppData\Local\Temp\2332223da5df70d3aca429110788a845.exe

Filesize
358KB

MD5
7af05d9bb2118ab1d1cac7ac8db0b0b2

SHA1
cc059769253469299a57aa1fa22431c5ccdbbdd5

SHA256
4d2a70209b6e68831f3cdda78e134a2bdaf04467f4ec186c6be65919a75d0783

SHA512
e1974954a0bd5e4749baba47d0953730d0799b9d6b53b74fb7fcf9d6d41978e03d71224a0c768e904c77edab5f2a9cef06d8a0f26eaa2d58f5467f87283edff9

Download Submit
memory/752-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2000-16-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2676-38-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2676-42-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2676-44-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2856-39-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2856-49-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2856-65-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download