Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 16:49

General

  • Target

    b92f530c26439241d67e177dce8a0cf8.exe

  • Size

    327KB

  • MD5

    b92f530c26439241d67e177dce8a0cf8

  • SHA1

    b4231023d24e8ad7efb4c5aeb37c455e21e5b073

  • SHA256

    206c3a864bd525d5fd95a328e8f6193a3e9429fbeacbe19023a5172a8d6e11e4

  • SHA512

    a6fd8b03e53e2b982ad35de1c57407ecfc488bfb908fdafe701f2a058869b15e1abed832c76e810aac60591d6b96a2ab16fd5015709821495b1ec152339c9584

  • SSDEEP

    3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBFH91p:L1XlKgzelZNQSBQGH/CSpWqTMmQA

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92f530c26439241d67e177dce8a0cf8.exe
    "C:\Users\Admin\AppData\Local\Temp\b92f530c26439241d67e177dce8a0cf8.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.cab

          Filesize

          544KB

          MD5

          9a1dd1d96481d61934dcc2d568971d06

          SHA1

          f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

          SHA256

          8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

          SHA512

          7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          380KB

          MD5

          969f744c57c79dcfbe6404cbdb77d965

          SHA1

          f39ccee7b0c9cba4e87118384df0422c8626546e

          SHA256

          4c1d1da4228a01a7f5705f10975db9a857eb199fbd021503463a36e6f991b2bd

          SHA512

          4722360f3f75b611468dbb19bd05b1d39cf33539aae12a526352785d84e9138e3b14029da38793649b9e1c8a406ae667247fd186b09a18d117cc64af15cc70b1

        • C:\Program Files\7-Zip\7zFM.cab

          Filesize

          520KB

          MD5

          eaf8600298b8dcec6a02901af8fb08b5

          SHA1

          a41b0b602d549112fe9ed9f51a6998d27bb8d0d4

          SHA256

          62be5bbe3f9e007036cd3c152180001acac07d077cc3be3325258416d9330e1a

          SHA512

          306999b6eb0813cd869d63600d593772d769e367da3d285a70eaf8d92c31fd146e954e37f9b3f6841d5181fa18a1e93763f42ddb62fec035afbd70d81c9db045

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

          Filesize

          281KB

          MD5

          3dc3594fb3b25c55081fe4b3226abbc2

          SHA1

          7eaddfd597fc76244f71f98877f7149c9e85dc9e

          SHA256

          6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e

          SHA512

          8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3639.tmp

          Filesize

          236KB

          MD5

          0d8626ee0ae4d13506e3d53ec0382a54

          SHA1

          d4b055a326e93ed47934bdcbd11eb7850e691411

          SHA256

          777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693

          SHA512

          20c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

          Filesize

          785KB

          MD5

          d56d9539cff62f9227c689bbb0e175c6

          SHA1

          02835b85162ce9e47dd53fa918126bc78d57d0e4

          SHA256

          87452a2c724f2ca88cc2c67ab1fec4cd3531d409384b2122cdfe5d78464fdd0f

          SHA512

          35b0124e956141fd4bf124c08712117fffc66fd4ea3dbdd445e0f290057a5e6ba42ba616e31eb134c506f5ae29b64acb4f415d092b801683c5f8f78a28ebb57d

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

          Filesize

          1.0MB

          MD5

          efdf9c9f053e58c1ffe6d7065ef48a07

          SHA1

          2ca152df8ae58c8653a34184b6e3ab162491938d

          SHA256

          04a7efaae6f1479ba3c9e23bff682d1c4027cd5e43ba37edad54aa7a226ec4a7

          SHA512

          5ad33ff9ea07bb173efda787851f49b94c12f6ab9c10e122be6f65da8fe9f80f001f924e134039c5f86ef6e283aebba7533d5892ab6869f45a2e456ea68e0460

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

          Filesize

          463KB

          MD5

          ae3adedff3e1a458211b4fa0487e0cac

          SHA1

          e1bb832bb63b11d2627fe725dee17636cc08c95a

          SHA256

          995d8bf14412cbb737ebbfd01ff2faaa6195117e7b42bc3e569dd69b6af9069e

          SHA512

          07dcca09b47896428529bc4a4c3a7b9f20ab7482bacff7f3d12d73e785424d09c614f08da846ad5513da65381ba687846370f265a313dda830468ba7c413d13d

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

          Filesize

          600KB

          MD5

          d083ad56c00a414d7fceb5ed56ab91f5

          SHA1

          e1809bc555ce4e09396044f9c6d01c9ecc366988

          SHA256

          accbc54e91a542fd5cc73295ae59227b409af2e4f1cba533a0110155c7cb6c3a

          SHA512

          516249c81f9e2c1b37214eedfd2481b4ea265679869ec5415333285da8275431f7089453fa86009f8549dd01021f8f42db7163da45dac1b4dd31ae604f330449

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

          Filesize

          419KB

          MD5

          592966b4412e61282448daa7480ae4d8

          SHA1

          e04f2f46ff83959d8d2cdba77cf9a17d3918c678

          SHA256

          e03f1d81db5d969dd36531ba542fa966151a424fe25196e8b9824c8e0bf4b63f

          SHA512

          b06bae6b9744473bcfe5cd739cfcebc6e498cdf9f3954ab7ed1a638a1a1813756fa3fa0a94f7909e5e49160b2c119644894e8dba92d12a6e3fe8a02b5ca74f51

        • C:\Program Files\Google\Chrome\Application\RCX3711.tmp

          Filesize

          236KB

          MD5

          2a59cb4ece9148c8b19a42e42cf1279b

          SHA1

          ec1f3e0e4f109adfaa471667fad9ce3f76701679

          SHA256

          800b273a6410a3ff19dce8279b00b50235c9849ebf262e2b47cb88c25c9b12d8

          SHA512

          7eeef546cd3018913855889b017cc7810277952ba83a3deca3bd9fae997f4f010d7efbb3885514862a3f4ea5095b74d8606320c28dd7f2913d40cd5e1fe0744e

        • C:\Program Files\Google\Chrome\Application\chrome.cab

          Filesize

          453KB

          MD5

          bca093dce2ad3c082695793a6e5777d7

          SHA1

          089fed0447e85fedab51b87ea5ae198aaf54ebff

          SHA256

          c8d792339fb896d9dfb43d7208f902b10f2f6ee663d791d9ada2f461e4cf758a

          SHA512

          26469f27ed5953f5dec90c399debc208a6cf0b89957279f69107e70b56ff9481e455b12119d0cb0c828b79071ad505c0fdbbf86db1f68d12e1a2381abd01587d

        • C:\Program Files\Google\Chrome\Application\chrome.exe

          Filesize

          750KB

          MD5

          b505af26bfeca41ed528385108382a61

          SHA1

          f32f69fb8009df2d9c547562042e147c592e8c31

          SHA256

          8b141591fe355f5c474ef015ac92a4cc125f6a622cf4eff82c1b0527a14a49f9

          SHA512

          0b7f8d8eeccead07ac3935855143d3753881c688021986f5c4412af392e005b0e33d31193a12fbc30e9c8b1355dff854f7345a2073fadaf58806149ebaa1f2ad

        • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

          Filesize

          534KB

          MD5

          8e776acb0f7a5da67d8b03da2a35decf

          SHA1

          d4b82b8ee02a2348775cdc3f1e12b6875277e345

          SHA256

          a4c8f64a3c0b8e9a2c49a0a3d30196cc850743118126a22fd370ed53326d6b23

          SHA512

          8d9fab69ef64aad58ab71b79a0392b06a6b1977260fd35ac748fec54a74953b163c69ad5abb114201cd9e9e034df79c0866308df88ccf277400c177feed36b70

        • C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab

          Filesize

          23KB

          MD5

          f63d14c000dfcadf2394c737edaeaec9

          SHA1

          1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8

          SHA256

          ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29

          SHA512

          4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053

        • C:\Program Files\Java\jdk-1.8\bin\extcheck.cab

          Filesize

          23KB

          MD5

          952fc862806f000e37d22897243c2bc4

          SHA1

          2da507ba99d86deee0fed3238e5e9fb170a562d2

          SHA256

          955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee

          SHA512

          c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05

        • C:\Program Files\Java\jre-1.8\bin\RCX3856.tmp

          Filesize

          236KB

          MD5

          2b0b864d8c4579fef0b2847741dac018

          SHA1

          bc98c839834a64767b51501a76b7e40d30bb809e

          SHA256

          98bfa1980ce67c8befe80f23c893373898bad9d1b19d79a32c41b2c3b4300766

          SHA512

          89e01b207759d6db689834cba21d2bd5095c2b7feb949c89b29ea591208658aa7912a9f6a941747e7099d2296ea05bcc6d37046eb1b00493b845a8a76eada5d8

        • C:\Program Files\Java\jre-1.8\bin\jabswitch.cab

          Filesize

          44KB

          MD5

          f0f1575cb0a27c0815cd6a6ee694c7a1

          SHA1

          347aabf545b26e24293e7983a34a88fb1f132ed3

          SHA256

          7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae

          SHA512

          6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a

        • C:\Program Files\Java\jre-1.8\bin\java-rmi.cab

          Filesize

          23KB

          MD5

          5aab08e129caf5c4595f21142e3c32bd

          SHA1

          1ee57e2d3e4939945939d4df180c1f9128fb2582

          SHA256

          ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf

          SHA512

          5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d

        • C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab

          Filesize

          238KB

          MD5

          3f1c773a2e54f4d27b29c3fc1edd7d43

          SHA1

          ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185

          SHA256

          ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254

          SHA512

          d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297

        • C:\Program Files\Mozilla Firefox\crashreporter.cab

          Filesize

          262KB

          MD5

          73603c36b4d1522c3402d67ecf657312

          SHA1

          6a964ae5d681455c320ea0f8611b79a99a35b283

          SHA256

          7fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4

          SHA512

          5fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238

        • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

          Filesize

          296KB

          MD5

          845f8c8c27fbb92b172a584480316858

          SHA1

          e6f968e5d0b27b6912b27846cdf6b498a52de85a

          SHA256

          991531c04bad114c25cb07f139893b4e1faf0373c2b02421c2a2cf5cfa4c48e9

          SHA512

          a64ec6a3043b377768066c44e287285141e78f3c1fb667eab1ead5754c12b2c00cb303c23847d4ed497472855f3e0a9d0388188f689271b94adae92080ec13ba

        • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

          Filesize

          425KB

          MD5

          daa3055cc499c8dad328bb65a4245e98

          SHA1

          70b09aeb5ea68277ad189a71a55b13b628030989

          SHA256

          ca476ee906743ce3c0082e4bf9366fc0b850d4030c22025fe9324326f1e3a213

          SHA512

          b70a97e425d60f80a10e77dca320a305cfed54971054f204317d09a3758012d1ab0856230e0c56ed0839f214db199f2a351bb4a929c4f0fdb3d5ddba0ef34cfd

        • C:\Program Files\dotnet\dotnet.cab

          Filesize

          138KB

          MD5

          b51fb63223915f23c60adc580c9a0531

          SHA1

          a22bf33ac2769c31c922c45f314b4d6e42ed77db

          SHA256

          b9eace03c8471717e3f98873527005dbd9a92367b954f8c48484d2b7b78efbac

          SHA512

          cd72aac2128c48c34568db1ac7b33e6934f31f473278426ef2acf9cd4df545dea8424bedf79340eb74a966ce39a3a7d9910fcbe456047d83330c62761644194d

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.cab

          Filesize

          56KB

          MD5

          48218aa6a473255fe6d47dcf3f0b7d6b

          SHA1

          65f9f03c3131da53389e3250a255eda418f18fc8

          SHA256

          76e459a20b870b91c42f525155ba94e8e2aa0ce82c4da46bdf2386321f6378b3

          SHA512

          bbf5edaf94bd8356dae4bfe63967c75044cf03c1844a67628f5b30e70a0d82dc74340466147614b48ffb48de25326bc28a2f366f776f9fb6bed98512aa275161