Analysis

  • max time kernel
    0s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2024, 15:44

General

  • Target

    70b058f19d396c4e0f05b09b9d944ea8.exe

  • Size

    359KB

  • MD5

    70b058f19d396c4e0f05b09b9d944ea8

  • SHA1

    5171e750815244d8ded1645e403b4ca153d76853

  • SHA256

    48fdac262a3dc4489f917713076714f3c2c6538c77fe5c3609bd357aa54aa53d

  • SHA512

    81c4eb14e3acda0859bcb5d1cd5a3908a6e9ee8e93838c0b43e5e6e91c0d162d4231160e5be7892176bc8475002a108993feb55a33943fa88c3f0d058f6ff6b2

  • SSDEEP

    6144:aZSE8UGJwiYwUfWeR7oHYnOW111mFW+tmQ:G3GFY/jWHYt1yW+gQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70b058f19d396c4e0f05b09b9d944ea8.exe
    "C:\Users\Admin\AppData\Local\Temp\70b058f19d396c4e0f05b09b9d944ea8.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    10KB

    MD5

    6c66efd204a3a79a0ce3201546d2565e

    SHA1

    83e4a3c12c9bdf93954605d6dc799f5751457d9f

    SHA256

    ccb27cfae68ee39d570ad99168ce2c4de40ec14d8d8843a33feb5586bc94bceb

    SHA512

    d883cfab68693be3a048768e9e94ea4371a8d9012e6f040ce750ebefab3d4e0a0965a73e997c55bdf4f680c9a95b1e8040094ffe2d5c65e53cebed67934bf9ca

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    5KB

    MD5

    a17d647f8c83695ea41b14c464260856

    SHA1

    e1f4b205fef1e7b15000e6733844633af3fe34a1

    SHA256

    8534ac22a59abf3c99f060535649ea99e88dc08be6e2735efbb20af78757f9dd

    SHA512

    ebb0a932c79cd1c7d192b42aedb6d418dd6c2f129d7572b13288bdfc9495a8f25d2c25393e8c1c3decb79e25e3103e12b5baea7ef993378b384d02dfdde4770c

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    6KB

    MD5

    1dfd9b0853609fbd910a6fa37aaa19f8

    SHA1

    9c067af0d5ace25e058c3c4ed0cd764659a94023

    SHA256

    93ca968074d55883c9d9ab8470ed9a48211a321ac36f5ce0f00e9cb0119d4e26

    SHA512

    df7f11a87b5c14033c4c2e445b82fd74f44bb217544ed81ade0dc77f9686b6666903a97ec3bbac4fb57cb39a5960b5110aac5ead7937ad2bc22b1e005fe492fe

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

    Filesize

    52KB

    MD5

    23515df127a8230e57bab0a9e52d286c

    SHA1

    b6f0fec5ec97e81a987a7e359db1bc5426b736df

    SHA256

    703455cab519ab88d8c79406808fb1d540bef3d0d3ff9787d7c40c8ea230fa23

    SHA512

    18f5e8cfb0fa6ac733b86c4a4d6726b71df3a837b982c98300f5d15abf245fc0dca7e0b5529ae5fd10a043cfc1f7ed1761c6a454f6e466ff684cf166c0f15d26

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

    Filesize

    15KB

    MD5

    9c99673b865378eb3ec712b6e3275835

    SHA1

    a27b598027c020f99b05ba7c5ec9cbe222a9f8d6

    SHA256

    c7b3ce57f1a8c5b606ebf2d29e207459575e82968d270162ff93bffab558762c

    SHA512

    cf93993e613ecde05a68fef8b296de5ce1cc7c62a6741dee4696000320e06ccd77807f8d5dc57c8dcf785c55ff8fa6635e41ad278bcb8fa2a9176463d4f74662

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1B15.tmp

    Filesize

    19KB

    MD5

    49ea7d4ee4b78362fbc7f9ddb141ffbb

    SHA1

    54ebc9326fda2eedd7988e458c65b4b47d073e0e

    SHA256

    3eca7dea1578fe71b2561e150dc4cab5983e53ea2439843de72a13ea6f7d05ea

    SHA512

    ce34b442101baab6bedddd0008d511e65cb8b4eaec91e573182f428cb2ae0a260e51f7993d4071478e417241aeeab65e6eff883544660bbe531d3fddb823a707

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

    Filesize

    1KB

    MD5

    f05ebed4c28d9b1360407cc63119ee7b

    SHA1

    e5337fe6293770ed6dabb54a500cec6faf4ceac6

    SHA256

    c3a506e1180aa8bce7e87175e58d2366667c27d66691a3a9c89ee198a0e73730

    SHA512

    0cc5e944ec84625c29b4884bb2348b232358bc169c5a294672d52112fe0a0babb51e53866b8bfe846609fd886a78d6a3ae61a852573f05f17a715a613352b430

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

    Filesize

    7KB

    MD5

    80dc1f24f5c7e7dc1cef166447e0ff77

    SHA1

    763c6d496b6f6be2092c5e80c497ef75215e69b9

    SHA256

    cff137ff8b8eeb655af71f5dfdd32f2d95c759f212ed0e68b1ffa1852037a614

    SHA512

    a2e4bf3cadf1c35a2e7111d0171d1c5a576c431e831387ce974a75721f62318f7226945532c7a551acde12511c397510213b87d845afc8f3d8303c0d21ff5818

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

    Filesize

    11KB

    MD5

    ac9b4fff49cca4109f02f19bbae316e5

    SHA1

    c2ea58f7151a8b687c5aa13758a2bd4193cbc4d0

    SHA256

    01324165a8fabb74f1bbb1e1ee871177b5c6adb2cee6467fd7424089d38ed31f

    SHA512

    5c4e7b17ce8a5762878bd7e957f8b78bd6ad50cdcc1c0d0a8bd4dd3e86b56f9d005ac4673738e7fc1e2f31f698835b56bcc01033d5275ccd945f7bac53c67ef1

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

    Filesize

    28KB

    MD5

    8ac1c3d09f76301bcc1435a5d1275c26

    SHA1

    2d41fd082cf4749d9a6a90ce48e3d789774bb3e7

    SHA256

    ffca30626301ad79977b8c590be376361a59fc17bed58b5d49ce5461cec212ef

    SHA512

    c00267ee40feb18ac1d95897d5af783731c3970cf4d7566c5442feb634d6c35a6df10eb1f6e110011edf027e5cdb5a3c9b032adf82a359bd5b142bb873cee93c

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    30KB

    MD5

    c32df1bc86d3d21452e0825969b24e45

    SHA1

    0389bbe66a59f0b62a3847a74e7c3ae4012d2618

    SHA256

    eea70357234530359cecb6a7ecf04175d6158aab2e33ec6d716d36a62c8c4ee4

    SHA512

    1a92f9eaedcc98c587bfb23272f43f7ce1b977f5bbea4ed9360f6901e789854ee624c45193b23997258e2cfc5f1f47b76d268af48e023f301b4d86e304bb4f2a

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    5KB

    MD5

    810c8808472f5df28bbf0cc815ba0390

    SHA1

    f4864b5e43b03714a66d5fd332bca4b048b46d32

    SHA256

    4763dc782617292ff686efb85da9fb2ee1b90b735833d8cc5b735a8f22d55911

    SHA512

    bd26edd3dd824e1bf39ae49507128e2a6246b08b1f4bcf6850b50b1c026c1a91d8215ae7d98ac51826bb358f30d137075d10d572d4e19382dda1a265a064a175

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    21KB

    MD5

    fa48ac1e978620ed92b73548dd0e4936

    SHA1

    4cae5b55cb4daf94388f2305edc6bf9c497000b6

    SHA256

    0f3055886a97919cb24ad690fb1d2565a4c57ff44b4fe98010b0bca6fc6b58b5

    SHA512

    545b19f2fa8d587f18b2d210b045fd6b061941c9ac281daadf9587b3e3b2cfdf7371c582a93a80230c79a2fec9ac91800a28d608456ac0ded08b861d4ff52431

  • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

    Filesize

    6KB

    MD5

    45ca90eb0218e21c994622f4f67cd378

    SHA1

    8bdc0aff6d5c73753c6f7129d2cd365e95a0d815

    SHA256

    342f0ba5d4ab6195d1b18f1eadff4daf30feb8912f9d81050f6515406eab60d3

    SHA512

    350aec73598c9a86eb9fc9eb32ba5563561d03611d2d8e896a52c3d7df1a90d0dd57d3adeb405cfd34687b51a2b25618c03872b46529348533bbde6f583270fd

  • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

    Filesize

    1KB

    MD5

    a50814d77dbf98ce396cfb0f46c044de

    SHA1

    f40661572d071b84177da4fd7c88a507db271c35

    SHA256

    1004a89286a1dd7c8019b2a4db4c2cef0d21f4e9d4d2c7833f939d248dc99141

    SHA512

    e12b46e274478b9b4932f92d1f7faa55de1248fb353f4b54c9dba1108269b9b2b7cfcf56a8c1cc4f16a8cd978ebda9a6605255bf002e611c13d338b875d101ce

  • C:\Program Files\Java\jre7\bin\jabswitch.cab

    Filesize

    12KB

    MD5

    cd85ad2bba5c043bd677e2c73e8055fc

    SHA1

    e687bbcd9462bea0cd90cd3fa067e4ab762e17d0

    SHA256

    d2977d01cbd072f16043d4ea39ab7ba986b949b26e4ca54860ab19032188a9d8

    SHA512

    55ce715c7b32408117f19c5eae4fc3398bbb07ce76b6372ba5d89f8450e25f31b8282626d04d7d29630f2d54266cfbd23dec6945ae56a9af6878c57383c97fbb

  • C:\Program Files\Microsoft Games\Chess\Chess.cab

    Filesize

    14KB

    MD5

    a221a49298cc131617afb5b80d9f2b9a

    SHA1

    749de3e48d9f6fbcb9c5cd8db4ed377d86ad4db8

    SHA256

    fac6872e1edf9d5632ce1bff0ad93fe579156b40ef89d00b6c49b8f922d9654c

    SHA512

    bda2389f0efae17abd7d56199ef1c6ae1d8c1e24f85c7b9e1e9985b1ee56ca7205ef720f31134af967afc1d5c1ac06f27f55933764070ea66ac607f2d78e7f88

  • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

    Filesize

    29KB

    MD5

    aa25290fb6235941def3c71008c47b7c

    SHA1

    0844f12c2bb15d8e9392758f3e502a249391bba8

    SHA256

    19f810e44b512fceab060c96439c8183b74a2bfd5bc83bf970a876d67425b8c3

    SHA512

    a927a299d0f2a5d1e4f3d30684ce75b5ae18956cccc6977e3d0e017b89a6e8be1607a878f58c2d6d5142f387b6feec0d7e286af5055ea2cab48b5b10e0968a67

  • C:\Program Files\Mozilla Firefox\crashreporter.cab

    Filesize

    19KB

    MD5

    e0ca82e4198b29368097478cf39d9057

    SHA1

    fa16a52487c480f451809d3b036b521c97929d00

    SHA256

    f178c8075a0f4bbc94a8aa84a2afd21c255389c30ec413658952d8c9917a1377

    SHA512

    782d3c9a7b76fc7b8cae39af84db669e0c34fb2f4edcdc52662ade6afc214a4ebccfaa3536bd3908262faf07aad8263c9c9a87bc6adefb704cc436a0bdd19b3b

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    5KB

    MD5

    ed05659d14ebc9e455fc780acfd95448

    SHA1

    9507c20b0803627bfb41945c656cff32d9983e78

    SHA256

    cca20806544d2625919e2b8ab579c262aa8d2388cb6d08f06f113cc34ebad96b

    SHA512

    8f300af74b9a208d6e53e57db313f82f3980f5e00baf36e5808a8729cf6c5167474a6777169b127ef24bdd76873e70cf9a9bd8ebf6a77c58151488f7c4994767

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    1KB

    MD5

    095855e46e0c21dcfe37da1ec04891f2

    SHA1

    93a6c933c04ce19d2b21fab4a42ae9b68eb7264d

    SHA256

    b45632a294312e871daac65abcb5ad5d144f920952111249c08206b9dc5eaf1d

    SHA512

    68ed9720f3df865c287165bf23132c7917507efa80c7860eaa08a2c10a124bada6ed85d322a3bdf3c93d145936cf08111806f28d8d6d434bb3be8326aa0cc5bf

  • C:\Program Files\VideoLAN\VLC\uninstall.cab

    Filesize

    1KB

    MD5

    88cc806e9e101a8160670a7050546028

    SHA1

    677f604bc1a1eb0e71d3dd0935f05584825252c6

    SHA256

    60a6063babd9f974c6edeca40c555a4a33fab5c3998cb71af77242f7370b0424

    SHA512

    e41b960b31d45b04492b9108d9906fbb6afa15262a949938438717582b12085a99dcba802ef32ba27b61c7675db574a7ee9e6c2bb1f0930f0a66bea3fde5c78e

  • C:\Program Files\VideoLAN\VLC\uninstall.exe

    Filesize

    19KB

    MD5

    084adfcf664ea962ddbd87b6b087d72d

    SHA1

    8efc38660f17c680fd431d072e4af7fc9763fbc2

    SHA256

    e103ba48741afaa796213424d264230ec0ee4f4896a4cd5cd494a8279bdcec3a

    SHA512

    495307aa81c295514ecc4625d70f85e7a88f44151a4f7e4080a51f6088f633f2c63a13b3fba80ef948c419117062b3f6ba4d235fc317ac303e3f690a7b44e859

  • memory/1732-598-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1732-0-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB