Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
b92f530c26439241d67e177dce8a0cf8.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b92f530c26439241d67e177dce8a0cf8.exe
Resource
win10v2004-20240226-en
General
-
Target
b92f530c26439241d67e177dce8a0cf8.exe
-
Size
327KB
-
MD5
b92f530c26439241d67e177dce8a0cf8
-
SHA1
b4231023d24e8ad7efb4c5aeb37c455e21e5b073
-
SHA256
206c3a864bd525d5fd95a328e8f6193a3e9429fbeacbe19023a5172a8d6e11e4
-
SHA512
a6fd8b03e53e2b982ad35de1c57407ecfc488bfb908fdafe701f2a058869b15e1abed832c76e810aac60591d6b96a2ab16fd5015709821495b1ec152339c9584
-
SSDEEP
3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBFH91p:L1XlKgzelZNQSBQGH/CSpWqTMmQA
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\K: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\M: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\N: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\O: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\G: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\H: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\I: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\J: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\L: b92f530c26439241d67e177dce8a0cf8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Mail\WinMail.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\RCX1450.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX15DB.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Mail\wab.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\setup_wm.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Internet Explorer\iexplore.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmplayer.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Defender\MSASCui.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows NT\Accessories\wordpad.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\RCX1451.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmprph.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX16D6.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Defender\MSASCui.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmpenc.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX14E8.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Microsoft Games\Chess\Chess.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmprph.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX14D1.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX1677.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Mail\wab.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\RCX143D.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX14E6.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1612.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX16C6.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Microsoft Games\Chess\RCX15EE.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Journal\Journal.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Windows Media Player\wmplayer.cab b92f530c26439241d67e177dce8a0cf8.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
380KB
MD5f4dc45f86dbbc1660b578d0f567c04e7
SHA1fc206d625d0bf43bc1b4e86b51df92b5368cb956
SHA256226c54fe5cafc510a36797e0a8174eeefe0b1a605af90c08c9b271f43c0668c4
SHA512a6c4e21cca32b289c5003351077f8c7c25cba45ed026f765aab5fdd6288f940456b3863fa5de15359c199befe9dce9ee6b9ae0361621bf54da1d5819e0ae627d
-
Filesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
316KB
MD5b3e2dc7d6bb7577ec95133b9532ebaa8
SHA19db1c49fc204d4e6484e57f9c97a7a2380a2054d
SHA256f6af08679a19845a30fa93310189c537ae6afb5910171f11304f57c82205dd2a
SHA51242fcb1fe3b1e3cd5f9fa2d85687fc9033c2b647caa7fe188c3e72c3267de1ae08e2d87f55c22c197d50122fbbe9f75f19ef434de9b654c60607bea4a2c8bde37
-
Filesize
118KB
MD5f45a7db6aec433fd579774dfdb3eaa89
SHA12f8773cc2b720143776a0909d19b98c4954b39cc
SHA2562bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA51203a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662
-
Filesize
236KB
MD50d8626ee0ae4d13506e3d53ec0382a54
SHA1d4b055a326e93ed47934bdcbd11eb7850e691411
SHA256777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693
SHA51220c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a
-
Filesize
1.4MB
MD50220fb0f0c479fc790cdaf2608596e83
SHA1c0bc7bf6184f64e94c40a838eb424818ef2dbb5c
SHA256d5d4bf77d956cd3e79c4c2257097887b9501968bb733b9e9fa8b9ccf2de6b95e
SHA512f6a739f275a62a49bbe4e52e09b826fd02c466337e598e687588dfc5a67866799d5adb8a51fac00716c656ecb0e2997ea307a030176e7fadcb245c3570937cfb
-
Filesize
1.3MB
MD505f3a660a21bc8e31ba993ebacd1adcf
SHA1d6e176c7591e5fb0d26798876e98b83110bb41d2
SHA2568f8ecabb6b8da2f57a7faa7034819d10592218933f65526c1dfb1b26465da2b3
SHA512f036300925af3fed4b2451d1fb965fd950b4a7656a3d139c178c8aa2818c56ed0682dd09c795c18662fac83532b3c5b360ffeca5b76574fff90a630d765b2ab7
-
Filesize
1.5MB
MD50500726b5016f7334ac0db66e15f3ddf
SHA1440974909190de38f61a299648268a91e4926ea0
SHA256119f35e48836a2a477dd5f885fbc188ed8de6bd60689cac26343522f4c8a8243
SHA512032c637ca25a95ae3303869a94a3634d45816ce4364e3bfc687792f4b084cd8717f0df48c1b83106d6c1b4c02f07b6224fb59364044e067d326a7254a3ceabf9
-
Filesize
1.3MB
MD5b589ba3e03a960268ff36746488487d6
SHA1bada655c1637916de8004b3fb632853d0d3c1af6
SHA256d1a0f0c41713b5ff3fa90f3eb1e35300c23a5b00afb9c3fa848979150c8573c1
SHA512f435c7ee7affc5438b42eb55a50288b654479964bc9341c89f534dae1db73ae32245e7364c6696a634f285f296059ea94bd88be9663beffe3b64116e82930a58
-
Filesize
236KB
MD57da11a6b4a94e75b2923ec0e4a396fc9
SHA1441ae20ba71bc046f3820c8f7053c07fef1089a9
SHA2565ddf2ec66b31cfba2292360f60be9e27f11773911dc88df5fe4530446daaf57c
SHA512c0b5effcc766009558bcfcd9de9aa738b696b58ffdde96469c62d9097aead83345cda95fedac5c77d4a37a826be0ca4d625ffed213d5433a23fc0716edd59b03
-
Filesize
1.7MB
MD5268c874f918cb0f3d757118e7c6be3a3
SHA1521914c76a2302d8faae7f8a53dd2616b5ac9249
SHA256db8d7f8ba89ce3382217c29a4becc2ba3706a8e17c8b0749a7aa31dd65839b27
SHA512a1d26369b5382ec982cded1e827b9b45645facf979b75831742fe61ffe79fdae57e58a9117aa421dcb4141298cd49d928263b5454fc22949772cf36e7d26371e
-
Filesize
1020KB
MD5b65d7344b0a7faa207d2e1a7adaafb60
SHA1755ad15b1745b0e730d658d4a92e2b754425b7db
SHA256f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92
SHA512f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22
-
Filesize
15KB
MD5c9aaf1247944e0928d6a7eae35e8cdc4
SHA1af91d57336d495bb220d8f72dcf59f34f5998fd3
SHA25605b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b
SHA512bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51
-
Filesize
15KB
MD5407d2d7dab36cdea871d4c6b9c62b258
SHA186cd158ad810c6772c22a5799c7acf4b9d7c9f57
SHA2563c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9
SHA512dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17
-
Filesize
54KB
MD5e795eb03297dd66d2efac2c33920a69f
SHA1bf41799164d6ab2690c39afa458122ed82f2d0a8
SHA256133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1
SHA5126a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef
-
Filesize
15KB
MD5d3827115574d8b0ecbaeb03528c6d1a4
SHA12733607537ffc00e038039af7eba24601db6fbeb
SHA2566ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f
SHA5122a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18
-
Filesize
1.4MB
MD541ee569b888a96f94f2c200786386587
SHA1ced3b85e72fb8fe147fb7b2df584a532ffe89e93
SHA256979d3b9654b635b63c86106a457d256f82a73f69ac5f362c52c02895502b6947
SHA512d442d9788591212961a9525d6b5794cf8b012b77661e5f3fd6a0cd707ea3d1e8eb2389482bc45d3facf189ff27001835db8cce238ffa3e1e9a477567df818431
-
Filesize
992KB
MD54e6d03408383f508b13beff41e63a9f1
SHA1c7cc7e4f89e5cb42d1538028910fd4cc884575e1
SHA2565e5e4c3750e4f522cbc69ef7191502639f30be27e17173b2771d4c81fd3e0e81
SHA512273d10e7883b9ef0a2cd5c9a3c8bfa92b5b9000d593a878c92a6fffece114dff0af59d2caa529421c321a115e9b533d910c5727436c8a2ab2361e251a802c820
-
Filesize
85KB
MD578e89dc545e6374c4e6c09c1d3ce0466
SHA1bcbfe02e7fed041894db6404e60690d02301b763
SHA256fabc7c12fd6523338f8adb3fefcaed7f213afe95e784ef36ecdf42da67421ab1
SHA5126f4dbd49e79c5e540ea9b35e4acbcaf7c294781691ee4681580048aa75671d9d3f48c4d474ec834d9c193d2c597302554a6ce6c10651a4cc9d11db284b0884f8
-
Filesize
262KB
MD573603c36b4d1522c3402d67ecf657312
SHA16a964ae5d681455c320ea0f8611b79a99a35b283
SHA2567fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4
SHA5125fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238
-
Filesize
312KB
MD5333482524eeeb34e3448e9b0ff9f7e14
SHA1d13ca4a6aaab1b230083658c4271b7054597e248
SHA256169ce39ae5919727a7562a25bf06aab26d53103406abdf5b5514571fb4b024ac
SHA512cb722fa1d8e9ad732a007a667339d2d51a26c3a3fd662c4124dce8707c260bea3b0f532e29b1dc9163d059632d1505e462df69c08d5dc9220f695328a3ced5de
-
Filesize
697KB
MD53fa2910cbd44b17be47ff26ef27c5157
SHA1d8a2bbcd3c88671b48478db293c61268fc24accf
SHA256d448206c75c51f8a44a1c7fd5dabb8b0505f670ecb2e5d2adf55791b9cef1b0c
SHA51216b70c679db2ba74a98f99956984fa044e96c821ccd5521b4882134c705b823674891d0521dc49c2391d5c184bbbd0c6d68890df65aad1972113aeda4f3b944a
-
Filesize
930KB
MD5027900a13b0f54d8ba7cb804c343b898
SHA1be27eabf8e9c86818cd4cbf0e3d658033b621ad9
SHA25648a1269563a1fa463c843019f6ecf5c36cc6a7df418cc81c86046922524fb91e
SHA512ccdcb32e6a3c17736a7ac552dc72004bc76ca6e4282547b63eae33e5b14f9bfefb2f57012a6077b60f613f8f081ff7d9b5abb0c8c75c22751346e99ba17634e1
-
Filesize
312KB
MD5de1a9270c974e334f2e3af034bc0f931
SHA1a1ddb7dd86bc67901e3c154acb7cb0fc91cbb382
SHA2560a31fc7f758714a6a2a5f925a6bda3d7841e2d747c03de0be486b63afae2e3f2
SHA5127ee7273bd8dfe70c9015214c2224626e1c5481b8cdef6e41ae8b53a933a923df19676b6a3de102df79fd22564d4ccaa347d16b71bc80037789ed30d1ca6ee80b
-
Filesize
228KB
MD55ba8b6e3a9d08a4fd4f71eed8cc56275
SHA15bfd77c8ddbca1dd2d4e6a9e08a0d89b50a654d0
SHA256e202657abb97ac953185c97f0d4e3d3133fe760d8b8c4e97a2c53d94bb8d58e2
SHA512e8242d974ff4c103cc1af4d44e55070abca619dfbae0fe450fb2dbe165a0af629c5e010bc0cbc5d7a8d40a2c420aacb3857f4d410f65235da8099379458fe419
-
Filesize
137KB
MD5b2bf2621b184914d48bb147d38f64392
SHA1b733404cf4231a069d47ca68b88118ddf05b18e0
SHA256276c5e546732a7b5585670943c84fe4ea782a601ad54ad4248605ad4ee916210
SHA5122966c8222af45c16c38a8341036ee58f65463d9874cc871639760b395cd8a3252e962b347e4b27c3aaf5735caeb5fc3154a29092d686642b66b49682662a168a