Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 05:46

General

  • Target

    7f0b00760674a48c17a21fa8be413787.exe

  • Size

    472KB

  • MD5

    7f0b00760674a48c17a21fa8be413787

  • SHA1

    504293f2b706ce80cee3c0dae0ba54769c852858

  • SHA256

    95c48ab2a16001b62882b61f5f333b01487d0e56517468faf3696933b3797175

  • SHA512

    b066eaed2f35e9d7d2c0818c10d2d62772e5cd28985ebcd6ac9e756089f41829b157af090e6fed78283701cae48a25880b128eb48eca552045e80ede6898ede1

  • SSDEEP

    6144:j1XlKgzelZNQSBQGH/CSpWqTmXDsBRHJeqqqdNnXDsBRHJeqtmQ:jUfBQGH6SfazwHJeS7nzwHJeNQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f0b00760674a48c17a21fa8be413787.exe
    "C:\Users\Admin\AppData\Local\Temp\7f0b00760674a48c17a21fa8be413787.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:2324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.cab

          Filesize

          544KB

          MD5

          9a1dd1d96481d61934dcc2d568971d06

          SHA1

          f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

          SHA256

          8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

          SHA512

          7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          520KB

          MD5

          2f1acee1e9aebce626e0ff2e0b2b02a4

          SHA1

          bafbeb86ca875876671ba2bcc527ed0e37f6241c

          SHA256

          b69a9a1deab30cc81aa300ec3408b5b9ccbd3dceab8484fa41bbb656b488f716

          SHA512

          f758e5178910c374b6e78ce8125df5e83b8fdedb0642544b6f6707bf8fba2319b12207a5897abc3d8f4a69674c1345a43496bae6b3c7f3a07d0a07be39f4e304

        • C:\Program Files\7-Zip\7zFM.cab

          Filesize

          930KB

          MD5

          30ac0b832d75598fb3ec37b6f2a8c86a

          SHA1

          6f47dbfd6ff36df7ba581a4cef024da527dc3046

          SHA256

          1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

          SHA512

          505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

          Filesize

          118KB

          MD5

          f45a7db6aec433fd579774dfdb3eaa89

          SHA1

          2f8773cc2b720143776a0909d19b98c4954b39cc

          SHA256

          2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

          SHA512

          03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX3F76.tmp

          Filesize

          236KB

          MD5

          0d8626ee0ae4d13506e3d53ec0382a54

          SHA1

          d4b055a326e93ed47934bdcbd11eb7850e691411

          SHA256

          777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693

          SHA512

          20c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

          Filesize

          263KB

          MD5

          b33ab5557f66680de588de7b51860cdb

          SHA1

          a101889b07e78a902dc7279ff9010279f8a80311

          SHA256

          f5edaea0df47ae01fc03c8eca4649f39c082d5dfed6b9c5d70e559651a1a5407

          SHA512

          d7a001f0be4f99400dbf379b2c17219118065681ca70ed2289d8d45630bd077535533d7bec83bf16524f391ae3bec3c2f86512760a2995e79c2109f18cb38be4

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

          Filesize

          1018KB

          MD5

          5a54f81739ff93099aa6dda11dbeba26

          SHA1

          f09f9f05305150ee417a9cb3b0f69421836f61bd

          SHA256

          a752cae406cbd3777eced1d7d912138e4f4549d9873e28ba0d6eec7ff655706a

          SHA512

          b21eeb42bf203d71fdeebc8ad40831d3beac3e046cc45989db455e3e7595c8f702d46949af5c77a7d9bc0125dbe629b644ad7d46dc87c9fca885f77ed145905f

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

          Filesize

          314KB

          MD5

          74751746348b7dbae839599e63b72e87

          SHA1

          7796786b218d266b3a80fb9a32059589e9f840a8

          SHA256

          056c814b8b19e481141f92b3f07cbb55a22e581ea47ceb3939e5212e70d838a2

          SHA512

          1edd41aea09229625ef4e6f3c5ef4a340437a772467d36808dea8d1978e5e347e2ce12d4bb44d2a210a32636ec96b93ef1e5bb9bd237f7248840014e48d36f93

        • C:\Program Files\Google\Chrome\Application\chrome.cab

          Filesize

          2.4MB

          MD5

          363bc5b1762d62879401129dbdabf9d5

          SHA1

          18615de6cf6c14bed03a3f59c23642626e233935

          SHA256

          ea1cc9b6be76598baa72a04681869a8079fbcc30ea72c935ed2bd804d1bcf617

          SHA512

          c046fc66715f772b6ae96a0252dfe16fce5bc12fc46644a226bf4449ef3c1cab734d20fda9b18246a50afa12776f3fb8eb53dd5e4ed76d224103db3f45556ca9

        • C:\Program Files\Google\Chrome\Application\chrome.exe

          Filesize

          236KB

          MD5

          a17ba308733dcc6a741c0104f732e947

          SHA1

          9d1a607004de46eab0518f6cd1883185c625a119

          SHA256

          e3f6cf9320baec9a0cc8ca8989e7e0f85ddf6adf7697cd6df5791624dc700917

          SHA512

          d4532361d9b96e686cfd8c4dd2042e12d774e55079b5a5d7bedab910a38d0efc046726560ce6ea9f218c5553c240694a87b1e15c76913c938a11444476635abe

        • C:\Program Files\Google\Chrome\Application\chrome.exe

          Filesize

          280KB

          MD5

          9543990562a3ddecf7ab1e8f172cc7f6

          SHA1

          ed1a587bae06982290865830829d2806e89c27ef

          SHA256

          1779649f3d46e1b3f9dcaf4a82aeb5a4e8342ecd347d003c79ddf6572d43518c

          SHA512

          6229c61fe4593782ee390f48ea448c6cb660ab36476fe9b58d02e5f8b6cd3404865b615b53838d3b97dd87924001721a2c79168ae084030e2921a589ecdedb12

        • C:\Program Files\Google\Chrome\Application\chrome.exe

          Filesize

          260KB

          MD5

          d820bf639e678755807e34a77375b3de

          SHA1

          98c6afd7f465be098393833a0c4bc7bf432ad6de

          SHA256

          b4b4562d36c0d922ef8ee70f71786623dc5a4ffdb5b15563ed4fec699e23c3fa

          SHA512

          1b0bf81affbe4dbdbaeb5a764518299a39da5f84711e67e70af72e66f97adcb33a7f73ff8dc5b68a642004701afae0dcf6ef93a06a80f2b11e0f73d4b22f417b

        • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

          Filesize

          994KB

          MD5

          c62ead695e12977b814fea30aa786738

          SHA1

          886fddde348635ba83008b1d4b7973e925a450ae

          SHA256

          a2038d4e9ad2842a5e3bd0b942aa464f5e46f268e288604af52b23345ad51199

          SHA512

          c7496cf86150a8f6b81a90afdaee7467a1740d0e31bea5b28c5cebb6ebb9dfc5376c4e14c4847063ed293740e1417f9a07ab258fd20659dea00a5175deaa382a

        • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

          Filesize

          15KB

          MD5

          c9aaf1247944e0928d6a7eae35e8cdc4

          SHA1

          af91d57336d495bb220d8f72dcf59f34f5998fd3

          SHA256

          05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

          SHA512

          bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

        • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

          Filesize

          15KB

          MD5

          407d2d7dab36cdea871d4c6b9c62b258

          SHA1

          86cd158ad810c6772c22a5799c7acf4b9d7c9f57

          SHA256

          3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

          SHA512

          dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

        • C:\Program Files\Java\jre7\bin\jabswitch.cab

          Filesize

          54KB

          MD5

          e795eb03297dd66d2efac2c33920a69f

          SHA1

          bf41799164d6ab2690c39afa458122ed82f2d0a8

          SHA256

          133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

          SHA512

          6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

        • C:\Program Files\Java\jre7\bin\java-rmi.cab

          Filesize

          15KB

          MD5

          d3827115574d8b0ecbaeb03528c6d1a4

          SHA1

          2733607537ffc00e038039af7eba24601db6fbeb

          SHA256

          6ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f

          SHA512

          2a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18

        • C:\Program Files\Java\jre7\bin\java-rmi.exe

          Filesize

          236KB

          MD5

          8e52c45fb549eb0b28d96f2df4ef2367

          SHA1

          c4c2ef58f82a29c25acd581bfdf8dae293f09912

          SHA256

          49bff9c8cbdc4a250fc586bf2898015583948ec47e8b300d9788305569c1c52f

          SHA512

          8d4675a705ab68c7a91e7c6134b9fd7503317780867a3c3c4ed7acfc565765e9a6899db355eb8f1d9f859d9bf65cebe800e1c0550f0a29c27b4cc167bdfeb377

        • C:\Program Files\Microsoft Games\Chess\Chess.cab

          Filesize

          68KB

          MD5

          1ce8afa7c8a19a9b996daf36355dea87

          SHA1

          279bdb209b8787cba8d6da3aaaf8e4957c8903c2

          SHA256

          3df34e2205ed393ec168afe37b17f0682455c02f197a084c8696e7c8fec53444

          SHA512

          633f1797e964e741d778e9bd68352da61d6ecd0f8fc423d03736eca9cf0666966a33dc04a21d8dd12dfc5af4d29632a76ce26d0001e35fdfc20fb10c151133cb

        • C:\Program Files\Microsoft Games\Chess\Chess.exe

          Filesize

          125KB

          MD5

          59c214057697f20037efb1e40387186d

          SHA1

          ccf72156a2def8d625f5fd950c4a1157289cc736

          SHA256

          a258d72ab3137abfdf30534c6b2184b8cd9e6967c1a95596698f7682da99976d

          SHA512

          33a2596ee45b1eda051f83007b6313ec713546459d98ad74a81f72b747024eebf55215917e66eb13fa1027f542250ce0471986c68af763f5bb522f538faa5b82

        • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

          Filesize

          44KB

          MD5

          dcb4ef95f9bafa352a283a72916204a7

          SHA1

          85e4e5f08471a7af896b4ec0c725857a8a5396c2

          SHA256

          38f1826a19dce5e4e93e393df9572cdfd78c311c809e0729620db7a51b4b0873

          SHA512

          6a00b0a0c8e0b7fbd511f3e754f0020889964ac93506ac3249a03e0e706bd4e251e9c0956a6335afeba630b59edc86fb5661d7b14b043b16cc7f137596d26f10

        • C:\Program Files\Mozilla Firefox\crashreporter.cab

          Filesize

          30KB

          MD5

          3add0ec7c432533adfab37eb44d2425a

          SHA1

          fb51835fc93b46f788f85657c012c6131a3cad7d

          SHA256

          7815754be88446430e7a4c9ac832263eae4903f8ed38ee0a4b24579e45d18ffa

          SHA512

          a433f2a1ea527e4828b230696cfeceaa480e63a19f4f8eb418dedcd8f7b9e13a6ff957cdf3fcd0579a84d67cad342269b1cf5c9a13c50160b9eaac6eb0812fa4

        • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

          Filesize

          69KB

          MD5

          9ff542e4130d851c06784f43444c087b

          SHA1

          ff376fe61cc6cd49c66d660fe972aa5976895611

          SHA256

          cba5094b6c3aebe970bf058a648d5313e09422e016e68c7233d363b0f3730370

          SHA512

          05229d4a9217e2c42d24cdb9089f9ee4fe653a0960447f98310d284a8421febdf3e41d9a8958399c0b99a1971b14419efdb574173c2fde0114b03b35295da473

        • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

          Filesize

          35KB

          MD5

          8929e9948a4d2d5cead2349fb6af95d8

          SHA1

          969a1674fd9206fe86b5ebd82d9dca9c6edfa85c

          SHA256

          005e28de56b490c6a69ee933240b2b829097ee6278de499824cd46307fbdd18a

          SHA512

          aae42c9700856ddfbc22afb2565f6114d6766b6df774714828af1fda97fdb8d2fb75633250585a319cbc3b456ae489805a5ac9d89e8c0807edfdd37cf133033b

        • C:\Program Files\VideoLAN\VLC\uninstall.cab

          Filesize

          110KB

          MD5

          eb7c61aca21bf94381abe18cb0ca8a13

          SHA1

          d41aaacce5f46c163fae2d8815a50e0980d12de4

          SHA256

          e6f94f12a4f0394b2979f064703c44de7401f37d195423b6a8176ef24232f7e0

          SHA512

          81c2e53d04a7ed44781eb16755d2ebb99bf947aeb393529f0b37c1336e838a186f8cfc28c3574455df12ea017d6aeae5e62ce11a70ed7af47d933bf4bd050d68

        • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab

          Filesize

          101KB

          MD5

          04104259b7499ab6154f441dcb8145fd

          SHA1

          7079a23b03de96e6096ec71bb7c87875b3046934

          SHA256

          706c419a35e5e13b0d48a9d075cbe17df98c8c4fd286cd163655235eac007f41

          SHA512

          b989a1d03ee570ffa93a1c3f0be97c9496e815def65490f78f788222339f6d47dbcdef1c36bebc1b05abd7186d2d4cc9d344b5be4617b58c7efd753704cf79be