Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 20:28

General

  • Target

    7a33320347199af40d65eed59dcc2a61.exe

  • Size

    547KB

  • MD5

    7a33320347199af40d65eed59dcc2a61

  • SHA1

    dee1f7559517bd0cad0ce1d177886ea8df17f2a4

  • SHA256

    ffa0a83de105cdc69f4adc8db6d3a3c60d6388ad8a977f7a5f51075244adc9d0

  • SHA512

    c825eb36edca5786e138ea159963dad14236afd8d673b1ee19498fb9d6bcea12788334a982b9587093bcbf20752dfd17183e50a9702c97b51bb2ea46536a3b49

  • SSDEEP

    3072:sPgp5XXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBW1pr/:UElKgzelZNQSBQGH/CSpWqTW

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a33320347199af40d65eed59dcc2a61.exe
    "C:\Users\Admin\AppData\Local\Temp\7a33320347199af40d65eed59dcc2a61.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:4360

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.cab

          Filesize

          92KB

          MD5

          3cdc659ac756a0987fc1150416c55348

          SHA1

          4e770f5195c436f34c3fe29e0759fe8c7fb6bd8b

          SHA256

          8083b2e27fc551e473ec2cb552ca915e117b7eb834319f21aba9f6d98bdf80a1

          SHA512

          d05007244ba97ee361fdad841e40c03acfb89a8c9cc7d8d8fd5994bcf08ad5e7213966cfcf3f87318bf57ea0ea5cc6bb5e32dd1c26f2dd479c046bd2d2824dee

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          52KB

          MD5

          9aca5d4ebeac9ad4556c337baa6318a6

          SHA1

          d10a511d2070e0cc66011339f0c336e77ee4aeaf

          SHA256

          9c19e3e2bd01fc3cd4cfab01c475ba656f0b3b360f3c4a7be7e45a3be83fdc78

          SHA512

          a74ff8b7517371fbd5e16caa305bd65b93455fbfaea13e45d86026b9a4d664a4c653ddda931e4742dfd70e77176b6a2855d285fcc16b6f6f0f1c94193910ecf8

        • C:\Program Files\7-Zip\7zFM.cab

          Filesize

          104KB

          MD5

          562eff50bb6ab20ee2356d56eeea8a60

          SHA1

          402aaadc266fa97c5503eda306e8abf9ce6e8265

          SHA256

          a8e8b657b9dec843e2e5e865f520328746bff0c214ff199816fa28220de755c2

          SHA512

          f37facddc9c2a3caed1b43b37077a2037c3968284ee85e7bd0988c07d8971fb328f64612ca539329e869d65deab429cef38cb4786c72b1a251951c432edf5b7b

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

          Filesize

          78KB

          MD5

          1a0e17ee7c199ea20d378b1491c2ee94

          SHA1

          1387c6d67aa7eb789d39e27ad3e7ac2e96f5ffec

          SHA256

          f791bed0740b7ec3f7bf9fca75f02038b931e9a1d9b4a7349c12e4db44ed68bb

          SHA512

          6e06d422839ce33f287d001c969749cef3aeda8c73da28354a5bae2e49d26d36c1452e1741a40e364b9a9e50f82b48b4d7ae4fa4232a60365eda8899e941510c

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9DFB.tmp

          Filesize

          100KB

          MD5

          251ed33c8924222ab38150791e62c85f

          SHA1

          be677f158afce66968e3244ec7dfbc831a6a66aa

          SHA256

          cab8d8c669b82fd3f0f94a55c860c1c8151563ef52cfb1bf8d6fb8c6dadf38a6

          SHA512

          2aa865f05bb4d0fe2e205972ef0d0d5e4aeb20a42f1cf44380d976ebc0ed2fbad41ffafcd13300ccaaa462a6d4c6ca4a8a61ed21782e5dc3195202410c2c5dab

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

          Filesize

          92KB

          MD5

          53f63e50b95a370237be6a564e4c0ff1

          SHA1

          4ed2ad0a1157a48fe801d671f8b625d2f023560d

          SHA256

          141c52f574c08134e97aed4b29ea35182cc2166c8bdb642ddd11f408fb07b451

          SHA512

          d1b56764cd02934c9a849aa2662d40a185d82f9fa89ac0cabf0d7cd6033b0b36a1a8ee5d9ca89ab31b0349b01e77bd65bb4c78dc0acbf18b6d3b8b819bdef428

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

          Filesize

          1.4MB

          MD5

          39806bc6f241c43f403611bbbf56e874

          SHA1

          7a5493325e2f3d41e6e9d89ccd40f227e1c91309

          SHA256

          2ac0de2f405dfb2f484468ae6561f75ef09151e8318b7ac272a821dd0903cdf4

          SHA512

          ac94418eb9b1be9b25a4f03a9823ee34818b954b47acd73048831200f8075349d3ca783d8a90d9775a53f1332cfb8c3abe62067f10a02279a048a38a58dfaff8

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

          Filesize

          310KB

          MD5

          c702ad7e469f8214bd2fe95496514afd

          SHA1

          22071375d987b04a121aebb5cb82f92df173f0c3

          SHA256

          d6b65835eeb6d44d58d115f42fd6eabe73c8ac6cc95a364c92122c2d5749c0ac

          SHA512

          9afdbd63f626b5f63aff4415dc3512fc7aa5b6965c71a8607046e66ba24191271cff48c49223ed8b5b9c9b782a62e3aa1b8f65d92942997dd4d82ff33d84f69e

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

          Filesize

          294KB

          MD5

          3bf573f3e48208858a9f0eab569fb4b9

          SHA1

          ceefeeb17b5d2ebad8f4debce8793368352fdf31

          SHA256

          c876f1099c93f47f4c6de101fbabd9699af1ac4aad48bab8677c99d67eff72e2

          SHA512

          c8507327e28170cabcdedc6a81e2a12726aa3fca62f4500f576e50fc276783bf45701b9c3b35ce5d834e3a7de733337e210768e3c696f643513ca3330b0924c2

        • C:\Program Files\Google\Chrome\Application\RCXA135.tmp

          Filesize

          39KB

          MD5

          1d2f5b2bb9276e063964c3e35f62aa36

          SHA1

          01bf4c8d3a79bae672919cf1b1496f202bcd7666

          SHA256

          f4c01e96349331f91528c8ddd2ddb939f89a21a6fecd058680d4baa38685a378

          SHA512

          75b8802d9d62af513e1447d855faa98e2b068637e5243fb6d817a5707b0063baaa70363a5d2d5af1e57fb2f8db6314d39e4306e19ec12fc1933e18a96ad9d288

        • C:\Program Files\Google\Chrome\Application\chrome.cab

          Filesize

          4KB

          MD5

          c9e2748929db65e5c67798993c4484bc

          SHA1

          f62d1637577e60f309cad012ce34804a80d694f1

          SHA256

          3656fe8d1d1012fbc866120a0c178fd56b1e15693ca22b0cb56a92aa742f17fd

          SHA512

          2ec411807a1591696ff09485a1aa6aa16c8686da7199b3b64e5d4bb8e214bf15eb0de23f61b607618f01cc79d68a930c9ac8aa721e6d7b4732002b00e7d9baa1

        • C:\Program Files\Java\jdk-1.8\bin\RCXA4D7.tmp

          Filesize

          381KB

          MD5

          34612635facc9b730eff61d90b7d5846

          SHA1

          636865575f0f249947146c268709a442cf36c68c

          SHA256

          08913f5fc4e28ae535c0ea67bbd8cc5279186eed931263bc33e9f79bb74358ce

          SHA512

          0cfb28231610d0c07984eee2568efc68f347f97a50658f5424dec7ab2aecdf53f3fda8bf51aaf74546ac169e55465633627b709cec9813118a155bd559b2445e

        • C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab

          Filesize

          23KB

          MD5

          f63d14c000dfcadf2394c737edaeaec9

          SHA1

          1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8

          SHA256

          ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29

          SHA512

          4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053

        • C:\Program Files\Java\jdk-1.8\bin\extcheck.cab

          Filesize

          23KB

          MD5

          952fc862806f000e37d22897243c2bc4

          SHA1

          2da507ba99d86deee0fed3238e5e9fb170a562d2

          SHA256

          955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee

          SHA512

          c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05

        • C:\Program Files\Java\jre-1.8\bin\jabswitch.cab

          Filesize

          44KB

          MD5

          f0f1575cb0a27c0815cd6a6ee694c7a1

          SHA1

          347aabf545b26e24293e7983a34a88fb1f132ed3

          SHA256

          7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae

          SHA512

          6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a

        • C:\Program Files\Java\jre-1.8\bin\jabswitch.exe

          Filesize

          251KB

          MD5

          a08024731c0dad3ca2978fbcba59a661

          SHA1

          1b6d18f0004f3a95faf77749d2c8c07e49b63a6e

          SHA256

          cabe5ec38bec499c00d08a02f8cff5a069a9bde1850cbe262076fe45b64ef56a

          SHA512

          7b5b7dbae118e6a2f538d937ad38fc2543b5694e4794ad2546e6329363ab18457a8f4a7b9857d5be33d9c94381b83d7bc53639b82606af2b1f7a84684c0df6d5

        • C:\Program Files\Java\jre-1.8\bin\java-rmi.cab

          Filesize

          23KB

          MD5

          5aab08e129caf5c4595f21142e3c32bd

          SHA1

          1ee57e2d3e4939945939d4df180c1f9128fb2582

          SHA256

          ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf

          SHA512

          5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d

        • C:\Program Files\Mozilla Firefox\crashreporter.cab

          Filesize

          262KB

          MD5

          73603c36b4d1522c3402d67ecf657312

          SHA1

          6a964ae5d681455c320ea0f8611b79a99a35b283

          SHA256

          7fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4

          SHA512

          5fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238

        • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

          Filesize

          327KB

          MD5

          8a332ac78dd16ca2ee794123f99e8919

          SHA1

          15a9e18a9e2842898155ead7679e296eb0c26181

          SHA256

          874721ec6b0c8eecc514d199d28d41b4b5d1c3e0ecb09aface53f3d7d82222e9

          SHA512

          95d348534b3e89fbfbef2a2184ac6c008c84a5593633aa801d2e22f610e699d7bf264c1a0038e3b9f94a939a3cef2fe2ca550e5da7441c18d732e6bb9dc6fa8c

        • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

          Filesize

          422KB

          MD5

          3f1c1adab847fc21b2064054f079a54b

          SHA1

          c41918c0ede2e2bbb7af9c2bcddf817fde1c0b90

          SHA256

          b0e1ee34f017cc7a45cb6cb79fe1e42c44cd10907af9d526f18b3d3091702fcc

          SHA512

          9d84e64935c569ac3cb866369d8a96d1e7d04a07ecd21bf58b3639b810c2f389949fed7e4ad14afcca21b0a6735d2289cf5eb46cf02b1003de5cd23be9863355

        • C:\Program Files\Mozilla Firefox\uninstall\helper.exe

          Filesize

          361KB

          MD5

          441bddd9784a75e4602248d727381feb

          SHA1

          26e860c17ffa70d557cb0dc87ecbd145453c47f3

          SHA256

          f8600004affdca4be4b15eedc86f9a5e5ea14465f1d5c5df9c559492be878335

          SHA512

          64a73838050937123f6cf4e0684a644786250509be2324394eb0ab5dc4e13c57151304ce08c6d84d1d6fbc7230959e4aa3c8cb1a258e0e986a45175626aafe4b

        • C:\Program Files\dotnet\dotnet.cab

          Filesize

          36KB

          MD5

          36103da1a2ee53d49cf878b72e0737ef

          SHA1

          bea4422ea4f184e459fa9f8ba279b351579623f4

          SHA256

          eda5394ebf98f9c7dd729565dc8fe2a3464e9c94eb934e52ae1b7c857a18748a

          SHA512

          a6ebdc5c81509b4c266560f963195b966221985e132c493c073e51bab348d2ebec1926233dc393e6bafaa70140b3c1835e1b13d385597303c6a428c85992978e

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.cab

          Filesize

          16KB

          MD5

          692b307a5cdc0ef55e6a51c92f8d67f7

          SHA1

          50736c9b0cebee64bc357e0e174175bd9c413d2d

          SHA256

          1d9865793993fb6e0c5e92d7873ce97643e6a8ca8424306114cd0edb3df5f980

          SHA512

          0a720e50964bf35cc97d56f69eb15a7d43943308ce33e99b2cb3d89aa474906cf916545167e96bd296e50f7e8858a5939bae934c6d5114bbbc14d2a497bdc312

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe

          Filesize

          63KB

          MD5

          a2968a9fc03cf7d28f1541dca0090303

          SHA1

          ebdef1de8ef8f8cb611e3784d55d32a00b8a26ce

          SHA256

          ffec0d971708ee4eb1174ddd92605ad7360dfb28a989e80306f5741307138131

          SHA512

          263955c49c0487948bd49ce9af7fa639baf9dbf74bbf8f20537c993fece2fe64a521553b3b3cd3c98aae043f7f78a52077e3d421086313e25d47a9158829b01e

        • memory/4360-0-0x0000000000400000-0x000000000048B000-memory.dmp

          Filesize

          556KB

        • memory/4360-490-0x0000000000400000-0x000000000048B000-memory.dmp

          Filesize

          556KB