Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
7f0b00760674a48c17a21fa8be413787.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f0b00760674a48c17a21fa8be413787.exe
Resource
win10v2004-20231215-en
General
-
Target
7f0b00760674a48c17a21fa8be413787.exe
-
Size
472KB
-
MD5
7f0b00760674a48c17a21fa8be413787
-
SHA1
504293f2b706ce80cee3c0dae0ba54769c852858
-
SHA256
95c48ab2a16001b62882b61f5f333b01487d0e56517468faf3696933b3797175
-
SHA512
b066eaed2f35e9d7d2c0818c10d2d62772e5cd28985ebcd6ac9e756089f41829b157af090e6fed78283701cae48a25880b128eb48eca552045e80ede6898ede1
-
SSDEEP
6144:j1XlKgzelZNQSBQGH/CSpWqTmXDsBRHJeqqqdNnXDsBRHJeqtmQ:jUfBQGH6SfazwHJeS7nzwHJeNQ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\G: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\H: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\K: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\L: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\M: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\N: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\E: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\I: 7f0b00760674a48c17a21fa8be413787.exe File opened (read-only) \??\J: 7f0b00760674a48c17a21fa8be413787.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\bin\java-rmi.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Defender\MSASCui.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX430C.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX42DB.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX434D.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX4380.tmp 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX407C.tmp 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Media Player\wmpnetwk.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\7-Zip\7z.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Mail\wabmig.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Mail\wabmig.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX416F.tmp 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows NT\Accessories\wordpad.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4026.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Defender\MpCmdRun.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\7-Zip\RCX3E5D.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX3F87.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\7-Zip\7z.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX431C.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4457.tmp 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Mail\WinMail.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX413B.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX41FE.tmp 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Journal\Journal.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Mail\WinMail.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX406B.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX415D.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX43E4.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Windows Journal\Journal.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX41DE.tmp 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab 7f0b00760674a48c17a21fa8be413787.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.cab 7f0b00760674a48c17a21fa8be413787.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 7f0b00760674a48c17a21fa8be413787.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
520KB
MD52f1acee1e9aebce626e0ff2e0b2b02a4
SHA1bafbeb86ca875876671ba2bcc527ed0e37f6241c
SHA256b69a9a1deab30cc81aa300ec3408b5b9ccbd3dceab8484fa41bbb656b488f716
SHA512f758e5178910c374b6e78ce8125df5e83b8fdedb0642544b6f6707bf8fba2319b12207a5897abc3d8f4a69674c1345a43496bae6b3c7f3a07d0a07be39f4e304
-
Filesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
118KB
MD5f45a7db6aec433fd579774dfdb3eaa89
SHA12f8773cc2b720143776a0909d19b98c4954b39cc
SHA2562bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA51203a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662
-
Filesize
236KB
MD50d8626ee0ae4d13506e3d53ec0382a54
SHA1d4b055a326e93ed47934bdcbd11eb7850e691411
SHA256777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693
SHA51220c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a
-
Filesize
263KB
MD5b33ab5557f66680de588de7b51860cdb
SHA1a101889b07e78a902dc7279ff9010279f8a80311
SHA256f5edaea0df47ae01fc03c8eca4649f39c082d5dfed6b9c5d70e559651a1a5407
SHA512d7a001f0be4f99400dbf379b2c17219118065681ca70ed2289d8d45630bd077535533d7bec83bf16524f391ae3bec3c2f86512760a2995e79c2109f18cb38be4
-
Filesize
1018KB
MD55a54f81739ff93099aa6dda11dbeba26
SHA1f09f9f05305150ee417a9cb3b0f69421836f61bd
SHA256a752cae406cbd3777eced1d7d912138e4f4549d9873e28ba0d6eec7ff655706a
SHA512b21eeb42bf203d71fdeebc8ad40831d3beac3e046cc45989db455e3e7595c8f702d46949af5c77a7d9bc0125dbe629b644ad7d46dc87c9fca885f77ed145905f
-
Filesize
314KB
MD574751746348b7dbae839599e63b72e87
SHA17796786b218d266b3a80fb9a32059589e9f840a8
SHA256056c814b8b19e481141f92b3f07cbb55a22e581ea47ceb3939e5212e70d838a2
SHA5121edd41aea09229625ef4e6f3c5ef4a340437a772467d36808dea8d1978e5e347e2ce12d4bb44d2a210a32636ec96b93ef1e5bb9bd237f7248840014e48d36f93
-
Filesize
2.4MB
MD5363bc5b1762d62879401129dbdabf9d5
SHA118615de6cf6c14bed03a3f59c23642626e233935
SHA256ea1cc9b6be76598baa72a04681869a8079fbcc30ea72c935ed2bd804d1bcf617
SHA512c046fc66715f772b6ae96a0252dfe16fce5bc12fc46644a226bf4449ef3c1cab734d20fda9b18246a50afa12776f3fb8eb53dd5e4ed76d224103db3f45556ca9
-
Filesize
236KB
MD5a17ba308733dcc6a741c0104f732e947
SHA19d1a607004de46eab0518f6cd1883185c625a119
SHA256e3f6cf9320baec9a0cc8ca8989e7e0f85ddf6adf7697cd6df5791624dc700917
SHA512d4532361d9b96e686cfd8c4dd2042e12d774e55079b5a5d7bedab910a38d0efc046726560ce6ea9f218c5553c240694a87b1e15c76913c938a11444476635abe
-
Filesize
280KB
MD59543990562a3ddecf7ab1e8f172cc7f6
SHA1ed1a587bae06982290865830829d2806e89c27ef
SHA2561779649f3d46e1b3f9dcaf4a82aeb5a4e8342ecd347d003c79ddf6572d43518c
SHA5126229c61fe4593782ee390f48ea448c6cb660ab36476fe9b58d02e5f8b6cd3404865b615b53838d3b97dd87924001721a2c79168ae084030e2921a589ecdedb12
-
Filesize
260KB
MD5d820bf639e678755807e34a77375b3de
SHA198c6afd7f465be098393833a0c4bc7bf432ad6de
SHA256b4b4562d36c0d922ef8ee70f71786623dc5a4ffdb5b15563ed4fec699e23c3fa
SHA5121b0bf81affbe4dbdbaeb5a764518299a39da5f84711e67e70af72e66f97adcb33a7f73ff8dc5b68a642004701afae0dcf6ef93a06a80f2b11e0f73d4b22f417b
-
Filesize
994KB
MD5c62ead695e12977b814fea30aa786738
SHA1886fddde348635ba83008b1d4b7973e925a450ae
SHA256a2038d4e9ad2842a5e3bd0b942aa464f5e46f268e288604af52b23345ad51199
SHA512c7496cf86150a8f6b81a90afdaee7467a1740d0e31bea5b28c5cebb6ebb9dfc5376c4e14c4847063ed293740e1417f9a07ab258fd20659dea00a5175deaa382a
-
Filesize
15KB
MD5c9aaf1247944e0928d6a7eae35e8cdc4
SHA1af91d57336d495bb220d8f72dcf59f34f5998fd3
SHA25605b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b
SHA512bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51
-
Filesize
15KB
MD5407d2d7dab36cdea871d4c6b9c62b258
SHA186cd158ad810c6772c22a5799c7acf4b9d7c9f57
SHA2563c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9
SHA512dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17
-
Filesize
54KB
MD5e795eb03297dd66d2efac2c33920a69f
SHA1bf41799164d6ab2690c39afa458122ed82f2d0a8
SHA256133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1
SHA5126a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef
-
Filesize
15KB
MD5d3827115574d8b0ecbaeb03528c6d1a4
SHA12733607537ffc00e038039af7eba24601db6fbeb
SHA2566ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f
SHA5122a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18
-
Filesize
236KB
MD58e52c45fb549eb0b28d96f2df4ef2367
SHA1c4c2ef58f82a29c25acd581bfdf8dae293f09912
SHA25649bff9c8cbdc4a250fc586bf2898015583948ec47e8b300d9788305569c1c52f
SHA5128d4675a705ab68c7a91e7c6134b9fd7503317780867a3c3c4ed7acfc565765e9a6899db355eb8f1d9f859d9bf65cebe800e1c0550f0a29c27b4cc167bdfeb377
-
Filesize
68KB
MD51ce8afa7c8a19a9b996daf36355dea87
SHA1279bdb209b8787cba8d6da3aaaf8e4957c8903c2
SHA2563df34e2205ed393ec168afe37b17f0682455c02f197a084c8696e7c8fec53444
SHA512633f1797e964e741d778e9bd68352da61d6ecd0f8fc423d03736eca9cf0666966a33dc04a21d8dd12dfc5af4d29632a76ce26d0001e35fdfc20fb10c151133cb
-
Filesize
125KB
MD559c214057697f20037efb1e40387186d
SHA1ccf72156a2def8d625f5fd950c4a1157289cc736
SHA256a258d72ab3137abfdf30534c6b2184b8cd9e6967c1a95596698f7682da99976d
SHA51233a2596ee45b1eda051f83007b6313ec713546459d98ad74a81f72b747024eebf55215917e66eb13fa1027f542250ce0471986c68af763f5bb522f538faa5b82
-
Filesize
44KB
MD5dcb4ef95f9bafa352a283a72916204a7
SHA185e4e5f08471a7af896b4ec0c725857a8a5396c2
SHA25638f1826a19dce5e4e93e393df9572cdfd78c311c809e0729620db7a51b4b0873
SHA5126a00b0a0c8e0b7fbd511f3e754f0020889964ac93506ac3249a03e0e706bd4e251e9c0956a6335afeba630b59edc86fb5661d7b14b043b16cc7f137596d26f10
-
Filesize
30KB
MD53add0ec7c432533adfab37eb44d2425a
SHA1fb51835fc93b46f788f85657c012c6131a3cad7d
SHA2567815754be88446430e7a4c9ac832263eae4903f8ed38ee0a4b24579e45d18ffa
SHA512a433f2a1ea527e4828b230696cfeceaa480e63a19f4f8eb418dedcd8f7b9e13a6ff957cdf3fcd0579a84d67cad342269b1cf5c9a13c50160b9eaac6eb0812fa4
-
Filesize
69KB
MD59ff542e4130d851c06784f43444c087b
SHA1ff376fe61cc6cd49c66d660fe972aa5976895611
SHA256cba5094b6c3aebe970bf058a648d5313e09422e016e68c7233d363b0f3730370
SHA51205229d4a9217e2c42d24cdb9089f9ee4fe653a0960447f98310d284a8421febdf3e41d9a8958399c0b99a1971b14419efdb574173c2fde0114b03b35295da473
-
Filesize
35KB
MD58929e9948a4d2d5cead2349fb6af95d8
SHA1969a1674fd9206fe86b5ebd82d9dca9c6edfa85c
SHA256005e28de56b490c6a69ee933240b2b829097ee6278de499824cd46307fbdd18a
SHA512aae42c9700856ddfbc22afb2565f6114d6766b6df774714828af1fda97fdb8d2fb75633250585a319cbc3b456ae489805a5ac9d89e8c0807edfdd37cf133033b
-
Filesize
110KB
MD5eb7c61aca21bf94381abe18cb0ca8a13
SHA1d41aaacce5f46c163fae2d8815a50e0980d12de4
SHA256e6f94f12a4f0394b2979f064703c44de7401f37d195423b6a8176ef24232f7e0
SHA51281c2e53d04a7ed44781eb16755d2ebb99bf947aeb393529f0b37c1336e838a186f8cfc28c3574455df12ea017d6aeae5e62ce11a70ed7af47d933bf4bd050d68
-
Filesize
101KB
MD504104259b7499ab6154f441dcb8145fd
SHA17079a23b03de96e6096ec71bb7c87875b3046934
SHA256706c419a35e5e13b0d48a9d075cbe17df98c8c4fd286cd163655235eac007f41
SHA512b989a1d03ee570ffa93a1c3f0be97c9496e815def65490f78f788222339f6d47dbcdef1c36bebc1b05abd7186d2d4cc9d344b5be4617b58c7efd753704cf79be