Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
b68053920e5654587c1c62e45f054f85.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b68053920e5654587c1c62e45f054f85.exe
Resource
win10v2004-20240226-en
General
-
Target
b68053920e5654587c1c62e45f054f85.exe
-
Size
285KB
-
MD5
b68053920e5654587c1c62e45f054f85
-
SHA1
47b3da71cbcffc802101ba26f01aaadecb86c031
-
SHA256
a5dc10cf0154dbb659963c7e3e78e1b98a17e143b1d0ed0571240b06e96ce8f7
-
SHA512
eee07846cda4256f51cdf4e2b6af0b71058db15b9b0f2657756d460678a254919a7f655657fac8004b16744c71a3fecbd12bb665061542e9a30b8df59a7d950f
-
SSDEEP
3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBku91W:L1XlKgzelZNQSBQGH/CSpWqTamQ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\G: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\J: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\K: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\M: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\N: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\E: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\H: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\I: b68053920e5654587c1c62e45f054f85.exe File opened (read-only) \??\L: b68053920e5654587c1c62e45f054f85.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX66B5.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6A28.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX653F.tmp b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Mail\wab.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX6843.tmp b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Internet Explorer\ieinstal.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX6B6B.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\VideoLAN\VLC\uninstall.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Journal\PDIALOG.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\7-Zip\7z.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\7-Zip\RCX6470.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX67D4.tmp b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmpenc.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmprph.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX661E.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX6737.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RCX6A07.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Java\jre7\bin\java-rmi.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\WMPDMC.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX662F.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6641.tmp b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Microsoft Games\Chess\Chess.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmpshare.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6640.tmp b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Media Player\wmplayer.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab b68053920e5654587c1c62e45f054f85.exe File created C:\Program Files\Windows Mail\wab.exe b68053920e5654587c1c62e45f054f85.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.cab b68053920e5654587c1c62e45f054f85.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD57a16c4e550a874285873ee6237b3c625
SHA1c54da7b12c5fe5ced5a9794cec3b3458798e1477
SHA256b5bb9dfb50a77cac50ae632a8deb488e8e8e8d2eadd7599edc200cd578f8aa0b
SHA512c658f3e436abfc9850edf77e085d72b49eabecd520dd1136694ca899b779605c0b64c54600fef024a67e7a66e541c67043c437d2d6b098aef66309fff9524731
-
Filesize
305KB
MD54dca9a0ad4446e8d8ee045c0740b0c80
SHA1df1dc0dde0a7ad8835e354c56534e31ce531a1e7
SHA256d71888785e5cbffb8e652bace5677cf5a48906434a55714b622ed88111e2419b
SHA5120a6b4524e2dc8cf3999d34220589c3ca7754b0c2934b7a58d806741c151e3c8de624743e9dd5f6bc20bc3d879212b54fc140bfe4ebd55fa49ab226414b9c4da9
-
Filesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
118KB
MD5f45a7db6aec433fd579774dfdb3eaa89
SHA12f8773cc2b720143776a0909d19b98c4954b39cc
SHA2562bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA51203a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662
-
Filesize
236KB
MD5ce539c345c00a1376ed052814576f1ba
SHA15f6156eab65f05f6b4fa65a5548a5b8909852968
SHA2562cd02698651e4b35790de83502fec11e1dc3c424d6c5473b710f220da0f883e2
SHA51279a2127a545ed77546f85397fcfcfb8241a5ad9fb8081353c145f995b37fc609299e919584c74a833978b5574fcc07b19855c6024cb28aca0c7ac43c99bd10eb
-
Filesize
668KB
MD5f2b9f7c40a56c9700ee7f88c37915a95
SHA126453b0d2f664cda3c52c38db4ffaa3d8bd3e572
SHA25613328c8b6bfbbd5dafb3fd016d1fd44bace34a22df3f36dae52388a2378ca356
SHA512b6b34f30b6f1c105ac76b2745d58931b02820fcb62bc67c25dd54bfff6d806e32f1203ddd1b76d6bdb39418b9eaed98b3921e846cffe264c875a05f40fa3a193
-
Filesize
791KB
MD547bbda6df1a9a2f84029fd0307abb6ab
SHA176441e399c0f6fa621dd93a9a1f882e52703a3ec
SHA256a31e838f9b11391c4e6dc223c9d1df6cd323d3792cb4559594723559f2aec276
SHA5126be58c54544d5d0ac4561acc6c02937f85a68b4e6c00f0d9aa7dd9aecb509fd2bcd3fd4e2d1223e781c4506b38f7f9a7620cf8e786ddaad0cf7e73b31949fa1c
-
Filesize
969KB
MD586507ebdde16c86caf0f42cffbfd75a7
SHA1c78e818fd425baf6f6f5843b8f72661714234372
SHA2566cf63e3bec9357e82937c900a6c2855ba44dbc09f9c34d976d4189a6d5a572ad
SHA51260bed7e145383f08fdd58fb2b7ace35c390e5b0a5430d32990114649799a57e026ce4b4b21a5fbd1318f8645d7363b17d3c7408763e3388a3b32e5812c3de2d3
-
Filesize
1.0MB
MD59d6e5c3654c788c98bd9488fedb83bf0
SHA11290660a653b3f5c25e3328e5969fea9647c1a02
SHA256572c8c8cf3638e164ae9b93af5206af72464975e662ef9297a71c4dbe5204e09
SHA51227fcc56910ccaffc25c9dd6b1fbcd35d20a6affc0d0a2bc892d9910a2539bf59e2f61791e79ef0d19ef21896b1167751991f9bc7c54f2131659cf1467b9c0a86
-
Filesize
924KB
MD53003084a5c3c837ff9f370d157c1a2b9
SHA12550c9b64c449ff24cd8ec7c44c49a896eb18e7b
SHA256166374559b557dfafd420c8cf6877a4e343e6ad104073dfcd1e7e42e2937a58f
SHA512d943e9dd74a999510098b1d476060348cf81c70407221c887f82c2a7082a430e5aab7c502113cbeb9cf09ce2f3bfaca3be7ffd159ec4780aacd8958d52a6fea9
-
Filesize
910KB
MD539c5a86da0cfd979a4bb0dbcada11eb8
SHA1ea73bc1d777db30ce0005eb3ac57a1c51ac4045a
SHA2563086864737f10d299cbdaff04704d2965de7f203f2e8420613ce9cc005ac720c
SHA512779c882435bb0f277097f57b7ee03bf6d08c4710b8eee2fc0d8f27d4f77923e632c95657b100955d70c6cd58e0b7c5ad169905e2b6f33a51f1767b6f58e14835
-
Filesize
15KB
MD5c9aaf1247944e0928d6a7eae35e8cdc4
SHA1af91d57336d495bb220d8f72dcf59f34f5998fd3
SHA25605b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b
SHA512bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51
-
Filesize
236KB
MD5140e2cb901ea1530029312bf1cb555f9
SHA14098d854f06ac7f60ff20697b71c1309ffe4d51e
SHA2563d2da452884fbf17d7577dd6ad5838976486db6bd567b14771bc93d6564fdd28
SHA5125da559b19ad7c15f88173198cfd92271f89356ef42f44c57ef324a4790a7b94bde90acfeb3ecf637fc1d386c99972a30c36c2754ebc1d47fbf4fecef5c265670
-
Filesize
15KB
MD5407d2d7dab36cdea871d4c6b9c62b258
SHA186cd158ad810c6772c22a5799c7acf4b9d7c9f57
SHA2563c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9
SHA512dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17
-
Filesize
236KB
MD5950ac4eb23995e8c2441b53743524842
SHA14f13d14299291bc802e074d578778409d295048b
SHA25633b9b7f8540b61f2a3682770413e312c02823dbdf394ed498e6b95bfb1f5ce20
SHA512cf95227d97980d2d9c2b0847e4ad235272b845b1d7c28547228965b2f5ebc98690cfbb70144d37968d888d7866981e0358b28deb089b5eba245c0bb2d1f2a1bb
-
Filesize
54KB
MD5e795eb03297dd66d2efac2c33920a69f
SHA1bf41799164d6ab2690c39afa458122ed82f2d0a8
SHA256133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1
SHA5126a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef
-
Filesize
236KB
MD519982c0698d3f912efaf2b38eef6d2c3
SHA16594684797740652277b511cc096ade74507b5e9
SHA256ed412e18ecd6b8d73d5b3eadcddc186160abf3fc95372f6b7aa256783c7123d2
SHA512359651b78f9e4234f4c4075fc1f539dbc48da8e519ad09f641c5b128472de0b137a5679ef3dfd778e5a109178e2b0f5c9a09b98075f7fd2b3991d46fe880e603
-
Filesize
15KB
MD5d3827115574d8b0ecbaeb03528c6d1a4
SHA12733607537ffc00e038039af7eba24601db6fbeb
SHA2566ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f
SHA5122a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18
-
Filesize
236KB
MD5b2366732a76563b18f4874707d736c85
SHA1b7d233426f836114d548ca7eec44fe06638ce0ea
SHA256567dfbcd15c75455ff51448a959cc58a0f757540dc6dccdddda11b948c223ab7
SHA5126a60611ea8ae1aac7c06b3f46e82e7ad5a885cef4977d1d30403bf929d91c847c8fd311df58feb3a65175ae325c8cfad43b69381222d8c5aa4cba63a1aee5ffb
-
Filesize
498KB
MD504ee38de6da650418d9fe60e5b2344a0
SHA1f16a41adaa6e2700e70734693866a5c95cafeefb
SHA256d9911e53401f764602e88c3cfc6f6deb694e473768d447d8d3eaf77ca07c58ea
SHA512f28f791b2e1d8154bdaf489eb3f5a88c3526862b76ad30918108b3b46e4524e7e99c461cd63fda209664781dc2f3883669ce2180b8f4d476c8543747e82af9a5
-
Filesize
85KB
MD578e89dc545e6374c4e6c09c1d3ce0466
SHA1bcbfe02e7fed041894db6404e60690d02301b763
SHA256fabc7c12fd6523338f8adb3fefcaed7f213afe95e784ef36ecdf42da67421ab1
SHA5126f4dbd49e79c5e540ea9b35e4acbcaf7c294781691ee4681580048aa75671d9d3f48c4d474ec834d9c193d2c597302554a6ce6c10651a4cc9d11db284b0884f8
-
Filesize
262KB
MD573603c36b4d1522c3402d67ecf657312
SHA16a964ae5d681455c320ea0f8611b79a99a35b283
SHA2567fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4
SHA5125fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238
-
Filesize
310KB
MD53177d5624c2ef406900077d87453913f
SHA1b2acb65a8850b092fb7c6c02e69bc6f71207b33e
SHA2566d0ecc2241a44b644dbd804cd94bb5436fbac5f1759452ba65bbb2d8fd2d6de9
SHA512ca35fddad85990aa27001d2c72d4aa4a0dc54933d75499fe74ca777e99f39743004099c8a3a4bfdcc421547497f59a4a53cb32ff1ba5fdefca38ee6383e4d020
-
Filesize
402KB
MD5eece33b832d6092f61ba35a8c4b03d04
SHA191ed4c908380b1caf594628c4f4356057f7ee4c9
SHA256cd6129441babb97b9e09134feb1e4f22ebe78e574683e1526797ab2932371909
SHA5127d752390af14552f839f48e6c25cadc2904a3b388abe3c62e569d1c3385b11226e7a52822d86c9a2aaa4bb5f2e8e4882e316bb5006706b3ef289c676fb08aebf
-
Filesize
468KB
MD540cac38aa437fe8a4c070effd70655c8
SHA1be93e409eb5d186131611d2335e017831dfe0191
SHA256945e7cbac699a59c8e9a5e8344b4d65894bf96b355165f6703ce09c3a665872f
SHA512509da1356c0abf014afde0aa05d37aac8d260ad2183e9fe5157410349c52d5c1b8910507aef26aa1dad685d0968651515847ff33972b3cd4ad47f97bb4f42dd6
-
Filesize
228KB
MD55ba8b6e3a9d08a4fd4f71eed8cc56275
SHA15bfd77c8ddbca1dd2d4e6a9e08a0d89b50a654d0
SHA256e202657abb97ac953185c97f0d4e3d3133fe760d8b8c4e97a2c53d94bb8d58e2
SHA512e8242d974ff4c103cc1af4d44e55070abca619dfbae0fe450fb2dbe165a0af629c5e010bc0cbc5d7a8d40a2c420aacb3857f4d410f65235da8099379458fe419
-
Filesize
137KB
MD5b2bf2621b184914d48bb147d38f64392
SHA1b733404cf4231a069d47ca68b88118ddf05b18e0
SHA256276c5e546732a7b5585670943c84fe4ea782a601ad54ad4248605ad4ee916210
SHA5122966c8222af45c16c38a8341036ee58f65463d9874cc871639760b395cd8a3252e962b347e4b27c3aaf5735caeb5fc3154a29092d686642b66b49682662a168a