20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

General

Target

20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
Size

35KB
MD5

9e3c13b6556d5636b745d3e466d47467
SHA1

2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA256

20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA512

5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP

768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 51 IoCs

Processes:

20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe

C:\Users\Admin\AppData\Local\Temp\20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
"C:\Users\Admin\AppData\Local\Temp\20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe"
1⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
C:\Users\Admin\AppData\Local\Temp\20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8.exe
1⤵
- Drops file in Program Files directory
PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/60-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/60-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4740-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads