Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
7a33320347199af40d65eed59dcc2a61.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7a33320347199af40d65eed59dcc2a61.exe
Resource
win10v2004-20231215-en
General
-
Target
7a33320347199af40d65eed59dcc2a61.exe
-
Size
547KB
-
MD5
7a33320347199af40d65eed59dcc2a61
-
SHA1
dee1f7559517bd0cad0ce1d177886ea8df17f2a4
-
SHA256
ffa0a83de105cdc69f4adc8db6d3a3c60d6388ad8a977f7a5f51075244adc9d0
-
SHA512
c825eb36edca5786e138ea159963dad14236afd8d673b1ee19498fb9d6bcea12788334a982b9587093bcbf20752dfd17183e50a9702c97b51bb2ea46536a3b49
-
SSDEEP
3072:sPgp5XXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBW1pr/:UElKgzelZNQSBQGH/CSpWqTW
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\L: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\O: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\G: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\H: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\I: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\N: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\E: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\K: 7a33320347199af40d65eed59dcc2a61.exe File opened (read-only) \??\M: 7a33320347199af40d65eed59dcc2a61.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9E2C.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\7-Zip\7z.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\RCX9D49.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXA258.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA218.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA1A5.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9DFC.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\RCX9F0D.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9FBA.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\readme.1xt 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\dotnet\RCX9E8C.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA155.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA319.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\RCX9D5A.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA339.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9DFB.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\dotnet\dotnet.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXA2B9.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA456.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\RCX9DAC.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA436.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA724.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\RCX9D7A.tmp 7a33320347199af40d65eed59dcc2a61.exe File created C:\Program Files\dotnet\dotnet.cab 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\RCX9D9C.tmp 7a33320347199af40d65eed59dcc2a61.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7a33320347199af40d65eed59dcc2a61.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD53cdc659ac756a0987fc1150416c55348
SHA14e770f5195c436f34c3fe29e0759fe8c7fb6bd8b
SHA2568083b2e27fc551e473ec2cb552ca915e117b7eb834319f21aba9f6d98bdf80a1
SHA512d05007244ba97ee361fdad841e40c03acfb89a8c9cc7d8d8fd5994bcf08ad5e7213966cfcf3f87318bf57ea0ea5cc6bb5e32dd1c26f2dd479c046bd2d2824dee
-
Filesize
52KB
MD59aca5d4ebeac9ad4556c337baa6318a6
SHA1d10a511d2070e0cc66011339f0c336e77ee4aeaf
SHA2569c19e3e2bd01fc3cd4cfab01c475ba656f0b3b360f3c4a7be7e45a3be83fdc78
SHA512a74ff8b7517371fbd5e16caa305bd65b93455fbfaea13e45d86026b9a4d664a4c653ddda931e4742dfd70e77176b6a2855d285fcc16b6f6f0f1c94193910ecf8
-
Filesize
104KB
MD5562eff50bb6ab20ee2356d56eeea8a60
SHA1402aaadc266fa97c5503eda306e8abf9ce6e8265
SHA256a8e8b657b9dec843e2e5e865f520328746bff0c214ff199816fa28220de755c2
SHA512f37facddc9c2a3caed1b43b37077a2037c3968284ee85e7bd0988c07d8971fb328f64612ca539329e869d65deab429cef38cb4786c72b1a251951c432edf5b7b
-
Filesize
78KB
MD51a0e17ee7c199ea20d378b1491c2ee94
SHA11387c6d67aa7eb789d39e27ad3e7ac2e96f5ffec
SHA256f791bed0740b7ec3f7bf9fca75f02038b931e9a1d9b4a7349c12e4db44ed68bb
SHA5126e06d422839ce33f287d001c969749cef3aeda8c73da28354a5bae2e49d26d36c1452e1741a40e364b9a9e50f82b48b4d7ae4fa4232a60365eda8899e941510c
-
Filesize
100KB
MD5251ed33c8924222ab38150791e62c85f
SHA1be677f158afce66968e3244ec7dfbc831a6a66aa
SHA256cab8d8c669b82fd3f0f94a55c860c1c8151563ef52cfb1bf8d6fb8c6dadf38a6
SHA5122aa865f05bb4d0fe2e205972ef0d0d5e4aeb20a42f1cf44380d976ebc0ed2fbad41ffafcd13300ccaaa462a6d4c6ca4a8a61ed21782e5dc3195202410c2c5dab
-
Filesize
92KB
MD553f63e50b95a370237be6a564e4c0ff1
SHA14ed2ad0a1157a48fe801d671f8b625d2f023560d
SHA256141c52f574c08134e97aed4b29ea35182cc2166c8bdb642ddd11f408fb07b451
SHA512d1b56764cd02934c9a849aa2662d40a185d82f9fa89ac0cabf0d7cd6033b0b36a1a8ee5d9ca89ab31b0349b01e77bd65bb4c78dc0acbf18b6d3b8b819bdef428
-
Filesize
1.4MB
MD539806bc6f241c43f403611bbbf56e874
SHA17a5493325e2f3d41e6e9d89ccd40f227e1c91309
SHA2562ac0de2f405dfb2f484468ae6561f75ef09151e8318b7ac272a821dd0903cdf4
SHA512ac94418eb9b1be9b25a4f03a9823ee34818b954b47acd73048831200f8075349d3ca783d8a90d9775a53f1332cfb8c3abe62067f10a02279a048a38a58dfaff8
-
Filesize
310KB
MD5c702ad7e469f8214bd2fe95496514afd
SHA122071375d987b04a121aebb5cb82f92df173f0c3
SHA256d6b65835eeb6d44d58d115f42fd6eabe73c8ac6cc95a364c92122c2d5749c0ac
SHA5129afdbd63f626b5f63aff4415dc3512fc7aa5b6965c71a8607046e66ba24191271cff48c49223ed8b5b9c9b782a62e3aa1b8f65d92942997dd4d82ff33d84f69e
-
Filesize
294KB
MD53bf573f3e48208858a9f0eab569fb4b9
SHA1ceefeeb17b5d2ebad8f4debce8793368352fdf31
SHA256c876f1099c93f47f4c6de101fbabd9699af1ac4aad48bab8677c99d67eff72e2
SHA512c8507327e28170cabcdedc6a81e2a12726aa3fca62f4500f576e50fc276783bf45701b9c3b35ce5d834e3a7de733337e210768e3c696f643513ca3330b0924c2
-
Filesize
39KB
MD51d2f5b2bb9276e063964c3e35f62aa36
SHA101bf4c8d3a79bae672919cf1b1496f202bcd7666
SHA256f4c01e96349331f91528c8ddd2ddb939f89a21a6fecd058680d4baa38685a378
SHA51275b8802d9d62af513e1447d855faa98e2b068637e5243fb6d817a5707b0063baaa70363a5d2d5af1e57fb2f8db6314d39e4306e19ec12fc1933e18a96ad9d288
-
Filesize
4KB
MD5c9e2748929db65e5c67798993c4484bc
SHA1f62d1637577e60f309cad012ce34804a80d694f1
SHA2563656fe8d1d1012fbc866120a0c178fd56b1e15693ca22b0cb56a92aa742f17fd
SHA5122ec411807a1591696ff09485a1aa6aa16c8686da7199b3b64e5d4bb8e214bf15eb0de23f61b607618f01cc79d68a930c9ac8aa721e6d7b4732002b00e7d9baa1
-
Filesize
381KB
MD534612635facc9b730eff61d90b7d5846
SHA1636865575f0f249947146c268709a442cf36c68c
SHA25608913f5fc4e28ae535c0ea67bbd8cc5279186eed931263bc33e9f79bb74358ce
SHA5120cfb28231610d0c07984eee2568efc68f347f97a50658f5424dec7ab2aecdf53f3fda8bf51aaf74546ac169e55465633627b709cec9813118a155bd559b2445e
-
Filesize
23KB
MD5f63d14c000dfcadf2394c737edaeaec9
SHA11c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8
SHA256ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
SHA5124cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053
-
Filesize
23KB
MD5952fc862806f000e37d22897243c2bc4
SHA12da507ba99d86deee0fed3238e5e9fb170a562d2
SHA256955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
SHA512c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05
-
Filesize
44KB
MD5f0f1575cb0a27c0815cd6a6ee694c7a1
SHA1347aabf545b26e24293e7983a34a88fb1f132ed3
SHA2567f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
SHA5126713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a
-
Filesize
251KB
MD5a08024731c0dad3ca2978fbcba59a661
SHA11b6d18f0004f3a95faf77749d2c8c07e49b63a6e
SHA256cabe5ec38bec499c00d08a02f8cff5a069a9bde1850cbe262076fe45b64ef56a
SHA5127b5b7dbae118e6a2f538d937ad38fc2543b5694e4794ad2546e6329363ab18457a8f4a7b9857d5be33d9c94381b83d7bc53639b82606af2b1f7a84684c0df6d5
-
Filesize
23KB
MD55aab08e129caf5c4595f21142e3c32bd
SHA11ee57e2d3e4939945939d4df180c1f9128fb2582
SHA256ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
SHA5125b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d
-
Filesize
262KB
MD573603c36b4d1522c3402d67ecf657312
SHA16a964ae5d681455c320ea0f8611b79a99a35b283
SHA2567fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4
SHA5125fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238
-
Filesize
327KB
MD58a332ac78dd16ca2ee794123f99e8919
SHA115a9e18a9e2842898155ead7679e296eb0c26181
SHA256874721ec6b0c8eecc514d199d28d41b4b5d1c3e0ecb09aface53f3d7d82222e9
SHA51295d348534b3e89fbfbef2a2184ac6c008c84a5593633aa801d2e22f610e699d7bf264c1a0038e3b9f94a939a3cef2fe2ca550e5da7441c18d732e6bb9dc6fa8c
-
Filesize
422KB
MD53f1c1adab847fc21b2064054f079a54b
SHA1c41918c0ede2e2bbb7af9c2bcddf817fde1c0b90
SHA256b0e1ee34f017cc7a45cb6cb79fe1e42c44cd10907af9d526f18b3d3091702fcc
SHA5129d84e64935c569ac3cb866369d8a96d1e7d04a07ecd21bf58b3639b810c2f389949fed7e4ad14afcca21b0a6735d2289cf5eb46cf02b1003de5cd23be9863355
-
Filesize
361KB
MD5441bddd9784a75e4602248d727381feb
SHA126e860c17ffa70d557cb0dc87ecbd145453c47f3
SHA256f8600004affdca4be4b15eedc86f9a5e5ea14465f1d5c5df9c559492be878335
SHA51264a73838050937123f6cf4e0684a644786250509be2324394eb0ab5dc4e13c57151304ce08c6d84d1d6fbc7230959e4aa3c8cb1a258e0e986a45175626aafe4b
-
Filesize
36KB
MD536103da1a2ee53d49cf878b72e0737ef
SHA1bea4422ea4f184e459fa9f8ba279b351579623f4
SHA256eda5394ebf98f9c7dd729565dc8fe2a3464e9c94eb934e52ae1b7c857a18748a
SHA512a6ebdc5c81509b4c266560f963195b966221985e132c493c073e51bab348d2ebec1926233dc393e6bafaa70140b3c1835e1b13d385597303c6a428c85992978e
-
Filesize
16KB
MD5692b307a5cdc0ef55e6a51c92f8d67f7
SHA150736c9b0cebee64bc357e0e174175bd9c413d2d
SHA2561d9865793993fb6e0c5e92d7873ce97643e6a8ca8424306114cd0edb3df5f980
SHA5120a720e50964bf35cc97d56f69eb15a7d43943308ce33e99b2cb3d89aa474906cf916545167e96bd296e50f7e8858a5939bae934c6d5114bbbc14d2a497bdc312
-
Filesize
63KB
MD5a2968a9fc03cf7d28f1541dca0090303
SHA1ebdef1de8ef8f8cb611e3784d55d32a00b8a26ce
SHA256ffec0d971708ee4eb1174ddd92605ad7360dfb28a989e80306f5741307138131
SHA512263955c49c0487948bd49ce9af7fa639baf9dbf74bbf8f20537c993fece2fe64a521553b3b3cd3c98aae043f7f78a52077e3d421086313e25d47a9158829b01e