Analysis
- max time kernel
62s - max time network
19s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
07/01/2024, 01:59
Static task
static1
1 signatures
windows7-x64
2 signatures
150 seconds
windows10-2004-x64
2 signatures
150 seconds
General
- Target [email protected]
- Size 211KB
- Sample240107-cedjlsdfd9
- SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
- MD5 b805db8f6a84475ef76b795b0d1ed6ae
- SHA1 7711cb4873e58b7adcf2a2b047b090e78d10c75b
- SHA512 62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
- SSDEEP 1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.ELM.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\DEEPBLUE.INF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_tr.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_te.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\RECOVR32.CNV.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODDBS.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ca.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_es.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\MSB1ENFR.ITS.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.ITS.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBLR6.CHM.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_fr.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PICTIM32.FLT.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.INF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\PREVIEW.GIF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psuser.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\ECLIPSE.INF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_bn.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_pt-BR.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ta.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.ELM.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psmachine_64.dll.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\JOURNAL.INF.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\THMBNAIL.PNG.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.990D66C408782F195F1CD2EA915DBFBB721B4DB1A40FE99F5EB91415AECC1416 [email protected] - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 [email protected] Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:2648