Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/03/2024, 21:48
Static task
static1
Behavioral task
behavioral1
Sample
7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe
Resource
win10v2004-20240226-en
General
-
Target
7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe
-
Size
1.6MB
-
MD5
2ac70ae8adc910576995ec41fc56d90d
-
SHA1
7f35d978d3ad2cc51c63c4f86c91d13c9e3f203b
-
SHA256
7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99
-
SHA512
f8ca56d9bb8844e9b4c2c3bc4d8661d25649c2e4ace2e4a3371d8aca5d93dddcaca08589cda8667203404744ecbf76f6fde5282507ab41cc07378b33c8d8e389
-
SSDEEP
12288:3RQBbI+I2X1DlACfYx2KPTvrmf8+5eC9veMlJHdr9nMQv9cYXqNiOIjQkcu:6B0LVxg5e6veM1XqjNzu
Malware Config
Signatures
-
Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral1/files/0x000c000000012249-3.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2736-11-0x0000000000A30000-0x0000000000A39000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2736-52-0x0000000000A30000-0x0000000000A39000-memory.dmp INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c000000012249-3.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2736 xFV.exe -
Loads dropped DLL 2 IoCs
pid Process 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe xFV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe xFV.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe xFV.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe xFV.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe xFV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe xFV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe xFV.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe xFV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe xFV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe xFV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe xFV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe xFV.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe xFV.exe File opened for modification C:\Program Files\7-Zip\7zG.exe xFV.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe xFV.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe xFV.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe xFV.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe xFV.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe xFV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe xFV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe xFV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe xFV.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe xFV.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2736 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe 29 PID 2964 wrote to memory of 2736 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe 29 PID 2964 wrote to memory of 2736 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe 29 PID 2964 wrote to memory of 2736 2964 7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe 29 PID 2736 wrote to memory of 2064 2736 xFV.exe 31 PID 2736 wrote to memory of 2064 2736 xFV.exe 31 PID 2736 wrote to memory of 2064 2736 xFV.exe 31 PID 2736 wrote to memory of 2064 2736 xFV.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe"C:\Users\Admin\AppData\Local\Temp\7afa252d9518da1ef77e4fb9c466e2e5fce7e01c18a73d1e26cf5b8699a04b99.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\xFV.exeC:\Users\Admin\AppData\Local\Temp\xFV.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\74fa37d6.bat" "3⤵PID:2064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
181B
MD55ff1262e2008f78a165336f63beb54b3
SHA167094e6a42e21d8a07acbdc9b9ddaee0c3f54dd7
SHA25688beb568d9a79adb90661fa24af906a8ed9680ff5ba6f84e3dce72bcfada14fc
SHA51237fa4b07df2af5f4310f71cf2c8e9766c5f96df734628dee094102a606111834a416666a1f9a923839f5218619b2e6b8b434e4628ab0654f66aba7e049aba077
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e