Analysis
-
max time kernel
0s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/01/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
70b058f19d396c4e0f05b09b9d944ea8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70b058f19d396c4e0f05b09b9d944ea8.exe
Resource
win10v2004-20231215-en
General
-
Target
70b058f19d396c4e0f05b09b9d944ea8.exe
-
Size
359KB
-
MD5
70b058f19d396c4e0f05b09b9d944ea8
-
SHA1
5171e750815244d8ded1645e403b4ca153d76853
-
SHA256
48fdac262a3dc4489f917713076714f3c2c6538c77fe5c3609bd357aa54aa53d
-
SHA512
81c4eb14e3acda0859bcb5d1cd5a3908a6e9ee8e93838c0b43e5e6e91c0d162d4231160e5be7892176bc8475002a108993feb55a33943fa88c3f0d058f6ff6b2
-
SSDEEP
6144:aZSE8UGJwiYwUfWeR7oHYnOW111mFW+tmQ:G3GFY/jWHYt1yW+gQ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\H: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\I: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\M: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\N: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\O: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\E: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\J: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\K: 70b058f19d396c4e0f05b09b9d944ea8.exe File opened (read-only) \??\L: 70b058f19d396c4e0f05b09b9d944ea8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1B86.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX1BBB.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX1BCB.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX1C61.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\7-Zip\RCX1AF3.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B5B.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B5D.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1BDD.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B47.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B5A.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B48.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1C02.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX1C63.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\7-Zip\7z.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\7-Zip\RCX1AF2.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RCX1C27.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX1C3D.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\VideoLAN\VLC\uninstall.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B70.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Internet Explorer\iexplore.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1BEE.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1C28.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX1C4E.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\readme.1xt 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1B26.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1B97.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1B59.tmp 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Java\jre7\bin\java-rmi.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\7-Zip\7z.exe 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab 70b058f19d396c4e0f05b09b9d944ea8.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 70b058f19d396c4e0f05b09b9d944ea8.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD56c66efd204a3a79a0ce3201546d2565e
SHA183e4a3c12c9bdf93954605d6dc799f5751457d9f
SHA256ccb27cfae68ee39d570ad99168ce2c4de40ec14d8d8843a33feb5586bc94bceb
SHA512d883cfab68693be3a048768e9e94ea4371a8d9012e6f040ce750ebefab3d4e0a0965a73e997c55bdf4f680c9a95b1e8040094ffe2d5c65e53cebed67934bf9ca
-
Filesize
5KB
MD5a17d647f8c83695ea41b14c464260856
SHA1e1f4b205fef1e7b15000e6733844633af3fe34a1
SHA2568534ac22a59abf3c99f060535649ea99e88dc08be6e2735efbb20af78757f9dd
SHA512ebb0a932c79cd1c7d192b42aedb6d418dd6c2f129d7572b13288bdfc9495a8f25d2c25393e8c1c3decb79e25e3103e12b5baea7ef993378b384d02dfdde4770c
-
Filesize
6KB
MD51dfd9b0853609fbd910a6fa37aaa19f8
SHA19c067af0d5ace25e058c3c4ed0cd764659a94023
SHA25693ca968074d55883c9d9ab8470ed9a48211a321ac36f5ce0f00e9cb0119d4e26
SHA512df7f11a87b5c14033c4c2e445b82fd74f44bb217544ed81ade0dc77f9686b6666903a97ec3bbac4fb57cb39a5960b5110aac5ead7937ad2bc22b1e005fe492fe
-
Filesize
52KB
MD523515df127a8230e57bab0a9e52d286c
SHA1b6f0fec5ec97e81a987a7e359db1bc5426b736df
SHA256703455cab519ab88d8c79406808fb1d540bef3d0d3ff9787d7c40c8ea230fa23
SHA51218f5e8cfb0fa6ac733b86c4a4d6726b71df3a837b982c98300f5d15abf245fc0dca7e0b5529ae5fd10a043cfc1f7ed1761c6a454f6e466ff684cf166c0f15d26
-
Filesize
15KB
MD59c99673b865378eb3ec712b6e3275835
SHA1a27b598027c020f99b05ba7c5ec9cbe222a9f8d6
SHA256c7b3ce57f1a8c5b606ebf2d29e207459575e82968d270162ff93bffab558762c
SHA512cf93993e613ecde05a68fef8b296de5ce1cc7c62a6741dee4696000320e06ccd77807f8d5dc57c8dcf785c55ff8fa6635e41ad278bcb8fa2a9176463d4f74662
-
Filesize
19KB
MD549ea7d4ee4b78362fbc7f9ddb141ffbb
SHA154ebc9326fda2eedd7988e458c65b4b47d073e0e
SHA2563eca7dea1578fe71b2561e150dc4cab5983e53ea2439843de72a13ea6f7d05ea
SHA512ce34b442101baab6bedddd0008d511e65cb8b4eaec91e573182f428cb2ae0a260e51f7993d4071478e417241aeeab65e6eff883544660bbe531d3fddb823a707
-
Filesize
1KB
MD5f05ebed4c28d9b1360407cc63119ee7b
SHA1e5337fe6293770ed6dabb54a500cec6faf4ceac6
SHA256c3a506e1180aa8bce7e87175e58d2366667c27d66691a3a9c89ee198a0e73730
SHA5120cc5e944ec84625c29b4884bb2348b232358bc169c5a294672d52112fe0a0babb51e53866b8bfe846609fd886a78d6a3ae61a852573f05f17a715a613352b430
-
Filesize
7KB
MD580dc1f24f5c7e7dc1cef166447e0ff77
SHA1763c6d496b6f6be2092c5e80c497ef75215e69b9
SHA256cff137ff8b8eeb655af71f5dfdd32f2d95c759f212ed0e68b1ffa1852037a614
SHA512a2e4bf3cadf1c35a2e7111d0171d1c5a576c431e831387ce974a75721f62318f7226945532c7a551acde12511c397510213b87d845afc8f3d8303c0d21ff5818
-
Filesize
11KB
MD5ac9b4fff49cca4109f02f19bbae316e5
SHA1c2ea58f7151a8b687c5aa13758a2bd4193cbc4d0
SHA25601324165a8fabb74f1bbb1e1ee871177b5c6adb2cee6467fd7424089d38ed31f
SHA5125c4e7b17ce8a5762878bd7e957f8b78bd6ad50cdcc1c0d0a8bd4dd3e86b56f9d005ac4673738e7fc1e2f31f698835b56bcc01033d5275ccd945f7bac53c67ef1
-
Filesize
28KB
MD58ac1c3d09f76301bcc1435a5d1275c26
SHA12d41fd082cf4749d9a6a90ce48e3d789774bb3e7
SHA256ffca30626301ad79977b8c590be376361a59fc17bed58b5d49ce5461cec212ef
SHA512c00267ee40feb18ac1d95897d5af783731c3970cf4d7566c5442feb634d6c35a6df10eb1f6e110011edf027e5cdb5a3c9b032adf82a359bd5b142bb873cee93c
-
Filesize
30KB
MD5c32df1bc86d3d21452e0825969b24e45
SHA10389bbe66a59f0b62a3847a74e7c3ae4012d2618
SHA256eea70357234530359cecb6a7ecf04175d6158aab2e33ec6d716d36a62c8c4ee4
SHA5121a92f9eaedcc98c587bfb23272f43f7ce1b977f5bbea4ed9360f6901e789854ee624c45193b23997258e2cfc5f1f47b76d268af48e023f301b4d86e304bb4f2a
-
Filesize
5KB
MD5810c8808472f5df28bbf0cc815ba0390
SHA1f4864b5e43b03714a66d5fd332bca4b048b46d32
SHA2564763dc782617292ff686efb85da9fb2ee1b90b735833d8cc5b735a8f22d55911
SHA512bd26edd3dd824e1bf39ae49507128e2a6246b08b1f4bcf6850b50b1c026c1a91d8215ae7d98ac51826bb358f30d137075d10d572d4e19382dda1a265a064a175
-
Filesize
21KB
MD5fa48ac1e978620ed92b73548dd0e4936
SHA14cae5b55cb4daf94388f2305edc6bf9c497000b6
SHA2560f3055886a97919cb24ad690fb1d2565a4c57ff44b4fe98010b0bca6fc6b58b5
SHA512545b19f2fa8d587f18b2d210b045fd6b061941c9ac281daadf9587b3e3b2cfdf7371c582a93a80230c79a2fec9ac91800a28d608456ac0ded08b861d4ff52431
-
Filesize
6KB
MD545ca90eb0218e21c994622f4f67cd378
SHA18bdc0aff6d5c73753c6f7129d2cd365e95a0d815
SHA256342f0ba5d4ab6195d1b18f1eadff4daf30feb8912f9d81050f6515406eab60d3
SHA512350aec73598c9a86eb9fc9eb32ba5563561d03611d2d8e896a52c3d7df1a90d0dd57d3adeb405cfd34687b51a2b25618c03872b46529348533bbde6f583270fd
-
Filesize
1KB
MD5a50814d77dbf98ce396cfb0f46c044de
SHA1f40661572d071b84177da4fd7c88a507db271c35
SHA2561004a89286a1dd7c8019b2a4db4c2cef0d21f4e9d4d2c7833f939d248dc99141
SHA512e12b46e274478b9b4932f92d1f7faa55de1248fb353f4b54c9dba1108269b9b2b7cfcf56a8c1cc4f16a8cd978ebda9a6605255bf002e611c13d338b875d101ce
-
Filesize
12KB
MD5cd85ad2bba5c043bd677e2c73e8055fc
SHA1e687bbcd9462bea0cd90cd3fa067e4ab762e17d0
SHA256d2977d01cbd072f16043d4ea39ab7ba986b949b26e4ca54860ab19032188a9d8
SHA51255ce715c7b32408117f19c5eae4fc3398bbb07ce76b6372ba5d89f8450e25f31b8282626d04d7d29630f2d54266cfbd23dec6945ae56a9af6878c57383c97fbb
-
Filesize
14KB
MD5a221a49298cc131617afb5b80d9f2b9a
SHA1749de3e48d9f6fbcb9c5cd8db4ed377d86ad4db8
SHA256fac6872e1edf9d5632ce1bff0ad93fe579156b40ef89d00b6c49b8f922d9654c
SHA512bda2389f0efae17abd7d56199ef1c6ae1d8c1e24f85c7b9e1e9985b1ee56ca7205ef720f31134af967afc1d5c1ac06f27f55933764070ea66ac607f2d78e7f88
-
Filesize
29KB
MD5aa25290fb6235941def3c71008c47b7c
SHA10844f12c2bb15d8e9392758f3e502a249391bba8
SHA25619f810e44b512fceab060c96439c8183b74a2bfd5bc83bf970a876d67425b8c3
SHA512a927a299d0f2a5d1e4f3d30684ce75b5ae18956cccc6977e3d0e017b89a6e8be1607a878f58c2d6d5142f387b6feec0d7e286af5055ea2cab48b5b10e0968a67
-
Filesize
19KB
MD5e0ca82e4198b29368097478cf39d9057
SHA1fa16a52487c480f451809d3b036b521c97929d00
SHA256f178c8075a0f4bbc94a8aa84a2afd21c255389c30ec413658952d8c9917a1377
SHA512782d3c9a7b76fc7b8cae39af84db669e0c34fb2f4edcdc52662ade6afc214a4ebccfaa3536bd3908262faf07aad8263c9c9a87bc6adefb704cc436a0bdd19b3b
-
Filesize
5KB
MD5ed05659d14ebc9e455fc780acfd95448
SHA19507c20b0803627bfb41945c656cff32d9983e78
SHA256cca20806544d2625919e2b8ab579c262aa8d2388cb6d08f06f113cc34ebad96b
SHA5128f300af74b9a208d6e53e57db313f82f3980f5e00baf36e5808a8729cf6c5167474a6777169b127ef24bdd76873e70cf9a9bd8ebf6a77c58151488f7c4994767
-
Filesize
1KB
MD5095855e46e0c21dcfe37da1ec04891f2
SHA193a6c933c04ce19d2b21fab4a42ae9b68eb7264d
SHA256b45632a294312e871daac65abcb5ad5d144f920952111249c08206b9dc5eaf1d
SHA51268ed9720f3df865c287165bf23132c7917507efa80c7860eaa08a2c10a124bada6ed85d322a3bdf3c93d145936cf08111806f28d8d6d434bb3be8326aa0cc5bf
-
Filesize
1KB
MD588cc806e9e101a8160670a7050546028
SHA1677f604bc1a1eb0e71d3dd0935f05584825252c6
SHA25660a6063babd9f974c6edeca40c555a4a33fab5c3998cb71af77242f7370b0424
SHA512e41b960b31d45b04492b9108d9906fbb6afa15262a949938438717582b12085a99dcba802ef32ba27b61c7675db574a7ee9e6c2bb1f0930f0a66bea3fde5c78e
-
Filesize
19KB
MD5084adfcf664ea962ddbd87b6b087d72d
SHA18efc38660f17c680fd431d072e4af7fc9763fbc2
SHA256e103ba48741afaa796213424d264230ec0ee4f4896a4cd5cd494a8279bdcec3a
SHA512495307aa81c295514ecc4625d70f85e7a88f44151a4f7e4080a51f6088f633f2c63a13b3fba80ef948c419117062b3f6ba4d235fc317ac303e3f690a7b44e859