Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2024, 04:25

General

  • Target

    b68053920e5654587c1c62e45f054f85.exe

  • Size

    285KB

  • MD5

    b68053920e5654587c1c62e45f054f85

  • SHA1

    47b3da71cbcffc802101ba26f01aaadecb86c031

  • SHA256

    a5dc10cf0154dbb659963c7e3e78e1b98a17e143b1d0ed0571240b06e96ce8f7

  • SHA512

    eee07846cda4256f51cdf4e2b6af0b71058db15b9b0f2657756d460678a254919a7f655657fac8004b16744c71a3fecbd12bb665061542e9a30b8df59a7d950f

  • SSDEEP

    3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBku91W:L1XlKgzelZNQSBQGH/CSpWqTamQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b68053920e5654587c1c62e45f054f85.exe
    "C:\Users\Admin\AppData\Local\Temp\b68053920e5654587c1c62e45f054f85.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    256KB

    MD5

    7a16c4e550a874285873ee6237b3c625

    SHA1

    c54da7b12c5fe5ced5a9794cec3b3458798e1477

    SHA256

    b5bb9dfb50a77cac50ae632a8deb488e8e8e8d2eadd7599edc200cd578f8aa0b

    SHA512

    c658f3e436abfc9850edf77e085d72b49eabecd520dd1136694ca899b779605c0b64c54600fef024a67e7a66e541c67043c437d2d6b098aef66309fff9524731

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    305KB

    MD5

    4dca9a0ad4446e8d8ee045c0740b0c80

    SHA1

    df1dc0dde0a7ad8835e354c56534e31ce531a1e7

    SHA256

    d71888785e5cbffb8e652bace5677cf5a48906434a55714b622ed88111e2419b

    SHA512

    0a6b4524e2dc8cf3999d34220589c3ca7754b0c2934b7a58d806741c151e3c8de624743e9dd5f6bc20bc3d879212b54fc140bfe4ebd55fa49ab226414b9c4da9

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    930KB

    MD5

    30ac0b832d75598fb3ec37b6f2a8c86a

    SHA1

    6f47dbfd6ff36df7ba581a4cef024da527dc3046

    SHA256

    1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

    SHA512

    505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

    Filesize

    118KB

    MD5

    f45a7db6aec433fd579774dfdb3eaa89

    SHA1

    2f8773cc2b720143776a0909d19b98c4954b39cc

    SHA256

    2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

    SHA512

    03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX653F.tmp

    Filesize

    236KB

    MD5

    ce539c345c00a1376ed052814576f1ba

    SHA1

    5f6156eab65f05f6b4fa65a5548a5b8909852968

    SHA256

    2cd02698651e4b35790de83502fec11e1dc3c424d6c5473b710f220da0f883e2

    SHA512

    79a2127a545ed77546f85397fcfcfb8241a5ad9fb8081353c145f995b37fc609299e919584c74a833978b5574fcc07b19855c6024cb28aca0c7ac43c99bd10eb

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

    Filesize

    668KB

    MD5

    f2b9f7c40a56c9700ee7f88c37915a95

    SHA1

    26453b0d2f664cda3c52c38db4ffaa3d8bd3e572

    SHA256

    13328c8b6bfbbd5dafb3fd016d1fd44bace34a22df3f36dae52388a2378ca356

    SHA512

    b6b34f30b6f1c105ac76b2745d58931b02820fcb62bc67c25dd54bfff6d806e32f1203ddd1b76d6bdb39418b9eaed98b3921e846cffe264c875a05f40fa3a193

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

    Filesize

    791KB

    MD5

    47bbda6df1a9a2f84029fd0307abb6ab

    SHA1

    76441e399c0f6fa621dd93a9a1f882e52703a3ec

    SHA256

    a31e838f9b11391c4e6dc223c9d1df6cd323d3792cb4559594723559f2aec276

    SHA512

    6be58c54544d5d0ac4561acc6c02937f85a68b4e6c00f0d9aa7dd9aecb509fd2bcd3fd4e2d1223e781c4506b38f7f9a7620cf8e786ddaad0cf7e73b31949fa1c

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

    Filesize

    969KB

    MD5

    86507ebdde16c86caf0f42cffbfd75a7

    SHA1

    c78e818fd425baf6f6f5843b8f72661714234372

    SHA256

    6cf63e3bec9357e82937c900a6c2855ba44dbc09f9c34d976d4189a6d5a572ad

    SHA512

    60bed7e145383f08fdd58fb2b7ace35c390e5b0a5430d32990114649799a57e026ce4b4b21a5fbd1318f8645d7363b17d3c7408763e3388a3b32e5812c3de2d3

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    1.0MB

    MD5

    9d6e5c3654c788c98bd9488fedb83bf0

    SHA1

    1290660a653b3f5c25e3328e5969fea9647c1a02

    SHA256

    572c8c8cf3638e164ae9b93af5206af72464975e662ef9297a71c4dbe5204e09

    SHA512

    27fcc56910ccaffc25c9dd6b1fbcd35d20a6affc0d0a2bc892d9910a2539bf59e2f61791e79ef0d19ef21896b1167751991f9bc7c54f2131659cf1467b9c0a86

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    924KB

    MD5

    3003084a5c3c837ff9f370d157c1a2b9

    SHA1

    2550c9b64c449ff24cd8ec7c44c49a896eb18e7b

    SHA256

    166374559b557dfafd420c8cf6877a4e343e6ad104073dfcd1e7e42e2937a58f

    SHA512

    d943e9dd74a999510098b1d476060348cf81c70407221c887f82c2a7082a430e5aab7c502113cbeb9cf09ce2f3bfaca3be7ffd159ec4780aacd8958d52a6fea9

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    910KB

    MD5

    39c5a86da0cfd979a4bb0dbcada11eb8

    SHA1

    ea73bc1d777db30ce0005eb3ac57a1c51ac4045a

    SHA256

    3086864737f10d299cbdaff04704d2965de7f203f2e8420613ce9cc005ac720c

    SHA512

    779c882435bb0f277097f57b7ee03bf6d08c4710b8eee2fc0d8f27d4f77923e632c95657b100955d70c6cd58e0b7c5ad169905e2b6f33a51f1767b6f58e14835

  • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

    Filesize

    15KB

    MD5

    c9aaf1247944e0928d6a7eae35e8cdc4

    SHA1

    af91d57336d495bb220d8f72dcf59f34f5998fd3

    SHA256

    05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

    SHA512

    bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

  • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

    Filesize

    236KB

    MD5

    140e2cb901ea1530029312bf1cb555f9

    SHA1

    4098d854f06ac7f60ff20697b71c1309ffe4d51e

    SHA256

    3d2da452884fbf17d7577dd6ad5838976486db6bd567b14771bc93d6564fdd28

    SHA512

    5da559b19ad7c15f88173198cfd92271f89356ef42f44c57ef324a4790a7b94bde90acfeb3ecf637fc1d386c99972a30c36c2754ebc1d47fbf4fecef5c265670

  • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

    Filesize

    15KB

    MD5

    407d2d7dab36cdea871d4c6b9c62b258

    SHA1

    86cd158ad810c6772c22a5799c7acf4b9d7c9f57

    SHA256

    3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

    SHA512

    dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

  • C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe

    Filesize

    236KB

    MD5

    950ac4eb23995e8c2441b53743524842

    SHA1

    4f13d14299291bc802e074d578778409d295048b

    SHA256

    33b9b7f8540b61f2a3682770413e312c02823dbdf394ed498e6b95bfb1f5ce20

    SHA512

    cf95227d97980d2d9c2b0847e4ad235272b845b1d7c28547228965b2f5ebc98690cfbb70144d37968d888d7866981e0358b28deb089b5eba245c0bb2d1f2a1bb

  • C:\Program Files\Java\jre7\bin\jabswitch.cab

    Filesize

    54KB

    MD5

    e795eb03297dd66d2efac2c33920a69f

    SHA1

    bf41799164d6ab2690c39afa458122ed82f2d0a8

    SHA256

    133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

    SHA512

    6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

  • C:\Program Files\Java\jre7\bin\jabswitch.exe

    Filesize

    236KB

    MD5

    19982c0698d3f912efaf2b38eef6d2c3

    SHA1

    6594684797740652277b511cc096ade74507b5e9

    SHA256

    ed412e18ecd6b8d73d5b3eadcddc186160abf3fc95372f6b7aa256783c7123d2

    SHA512

    359651b78f9e4234f4c4075fc1f539dbc48da8e519ad09f641c5b128472de0b137a5679ef3dfd778e5a109178e2b0f5c9a09b98075f7fd2b3991d46fe880e603

  • C:\Program Files\Java\jre7\bin\java-rmi.cab

    Filesize

    15KB

    MD5

    d3827115574d8b0ecbaeb03528c6d1a4

    SHA1

    2733607537ffc00e038039af7eba24601db6fbeb

    SHA256

    6ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f

    SHA512

    2a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18

  • C:\Program Files\Java\jre7\bin\java-rmi.exe

    Filesize

    236KB

    MD5

    b2366732a76563b18f4874707d736c85

    SHA1

    b7d233426f836114d548ca7eec44fe06638ce0ea

    SHA256

    567dfbcd15c75455ff51448a959cc58a0f757540dc6dccdddda11b948c223ab7

    SHA512

    6a60611ea8ae1aac7c06b3f46e82e7ad5a885cef4977d1d30403bf929d91c847c8fd311df58feb3a65175ae325c8cfad43b69381222d8c5aa4cba63a1aee5ffb

  • C:\Program Files\Microsoft Games\Chess\Chess.cab

    Filesize

    498KB

    MD5

    04ee38de6da650418d9fe60e5b2344a0

    SHA1

    f16a41adaa6e2700e70734693866a5c95cafeefb

    SHA256

    d9911e53401f764602e88c3cfc6f6deb694e473768d447d8d3eaf77ca07c58ea

    SHA512

    f28f791b2e1d8154bdaf489eb3f5a88c3526862b76ad30918108b3b46e4524e7e99c461cd63fda209664781dc2f3883669ce2180b8f4d476c8543747e82af9a5

  • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

    Filesize

    85KB

    MD5

    78e89dc545e6374c4e6c09c1d3ce0466

    SHA1

    bcbfe02e7fed041894db6404e60690d02301b763

    SHA256

    fabc7c12fd6523338f8adb3fefcaed7f213afe95e784ef36ecdf42da67421ab1

    SHA512

    6f4dbd49e79c5e540ea9b35e4acbcaf7c294781691ee4681580048aa75671d9d3f48c4d474ec834d9c193d2c597302554a6ce6c10651a4cc9d11db284b0884f8

  • C:\Program Files\Mozilla Firefox\crashreporter.cab

    Filesize

    262KB

    MD5

    73603c36b4d1522c3402d67ecf657312

    SHA1

    6a964ae5d681455c320ea0f8611b79a99a35b283

    SHA256

    7fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4

    SHA512

    5fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238

  • C:\Program Files\Mozilla Firefox\crashreporter.exe

    Filesize

    310KB

    MD5

    3177d5624c2ef406900077d87453913f

    SHA1

    b2acb65a8850b092fb7c6c02e69bc6f71207b33e

    SHA256

    6d0ecc2241a44b644dbd804cd94bb5436fbac5f1759452ba65bbb2d8fd2d6de9

    SHA512

    ca35fddad85990aa27001d2c72d4aa4a0dc54933d75499fe74ca777e99f39743004099c8a3a4bfdcc421547497f59a4a53cb32ff1ba5fdefca38ee6383e4d020

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    402KB

    MD5

    eece33b832d6092f61ba35a8c4b03d04

    SHA1

    91ed4c908380b1caf594628c4f4356057f7ee4c9

    SHA256

    cd6129441babb97b9e09134feb1e4f22ebe78e574683e1526797ab2932371909

    SHA512

    7d752390af14552f839f48e6c25cadc2904a3b388abe3c62e569d1c3385b11226e7a52822d86c9a2aaa4bb5f2e8e4882e316bb5006706b3ef289c676fb08aebf

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    468KB

    MD5

    40cac38aa437fe8a4c070effd70655c8

    SHA1

    be93e409eb5d186131611d2335e017831dfe0191

    SHA256

    945e7cbac699a59c8e9a5e8344b4d65894bf96b355165f6703ce09c3a665872f

    SHA512

    509da1356c0abf014afde0aa05d37aac8d260ad2183e9fe5157410349c52d5c1b8910507aef26aa1dad685d0968651515847ff33972b3cd4ad47f97bb4f42dd6

  • C:\Program Files\VideoLAN\VLC\uninstall.cab

    Filesize

    228KB

    MD5

    5ba8b6e3a9d08a4fd4f71eed8cc56275

    SHA1

    5bfd77c8ddbca1dd2d4e6a9e08a0d89b50a654d0

    SHA256

    e202657abb97ac953185c97f0d4e3d3133fe760d8b8c4e97a2c53d94bb8d58e2

    SHA512

    e8242d974ff4c103cc1af4d44e55070abca619dfbae0fe450fb2dbe165a0af629c5e010bc0cbc5d7a8d40a2c420aacb3857f4d410f65235da8099379458fe419

  • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab

    Filesize

    137KB

    MD5

    b2bf2621b184914d48bb147d38f64392

    SHA1

    b733404cf4231a069d47ca68b88118ddf05b18e0

    SHA256

    276c5e546732a7b5585670943c84fe4ea782a601ad54ad4248605ad4ee916210

    SHA512

    2966c8222af45c16c38a8341036ee58f65463d9874cc871639760b395cd8a3252e962b347e4b27c3aaf5735caeb5fc3154a29092d686642b66b49682662a168a