Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 16:49

General

  • Target

    b92f530c26439241d67e177dce8a0cf8.exe

  • Size

    327KB

  • MD5

    b92f530c26439241d67e177dce8a0cf8

  • SHA1

    b4231023d24e8ad7efb4c5aeb37c455e21e5b073

  • SHA256

    206c3a864bd525d5fd95a328e8f6193a3e9429fbeacbe19023a5172a8d6e11e4

  • SHA512

    a6fd8b03e53e2b982ad35de1c57407ecfc488bfb908fdafe701f2a058869b15e1abed832c76e810aac60591d6b96a2ab16fd5015709821495b1ec152339c9584

  • SSDEEP

    3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBFH91p:L1XlKgzelZNQSBQGH/CSpWqTMmQA

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92f530c26439241d67e177dce8a0cf8.exe
    "C:\Users\Admin\AppData\Local\Temp\b92f530c26439241d67e177dce8a0cf8.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    544KB

    MD5

    9a1dd1d96481d61934dcc2d568971d06

    SHA1

    f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

    SHA256

    8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

    SHA512

    7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    380KB

    MD5

    969f744c57c79dcfbe6404cbdb77d965

    SHA1

    f39ccee7b0c9cba4e87118384df0422c8626546e

    SHA256

    4c1d1da4228a01a7f5705f10975db9a857eb199fbd021503463a36e6f991b2bd

    SHA512

    4722360f3f75b611468dbb19bd05b1d39cf33539aae12a526352785d84e9138e3b14029da38793649b9e1c8a406ae667247fd186b09a18d117cc64af15cc70b1

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    520KB

    MD5

    eaf8600298b8dcec6a02901af8fb08b5

    SHA1

    a41b0b602d549112fe9ed9f51a6998d27bb8d0d4

    SHA256

    62be5bbe3f9e007036cd3c152180001acac07d077cc3be3325258416d9330e1a

    SHA512

    306999b6eb0813cd869d63600d593772d769e367da3d285a70eaf8d92c31fd146e954e37f9b3f6841d5181fa18a1e93763f42ddb62fec035afbd70d81c9db045

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

    Filesize

    281KB

    MD5

    3dc3594fb3b25c55081fe4b3226abbc2

    SHA1

    7eaddfd597fc76244f71f98877f7149c9e85dc9e

    SHA256

    6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e

    SHA512

    8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3639.tmp

    Filesize

    236KB

    MD5

    0d8626ee0ae4d13506e3d53ec0382a54

    SHA1

    d4b055a326e93ed47934bdcbd11eb7850e691411

    SHA256

    777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693

    SHA512

    20c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

    Filesize

    785KB

    MD5

    d56d9539cff62f9227c689bbb0e175c6

    SHA1

    02835b85162ce9e47dd53fa918126bc78d57d0e4

    SHA256

    87452a2c724f2ca88cc2c67ab1fec4cd3531d409384b2122cdfe5d78464fdd0f

    SHA512

    35b0124e956141fd4bf124c08712117fffc66fd4ea3dbdd445e0f290057a5e6ba42ba616e31eb134c506f5ae29b64acb4f415d092b801683c5f8f78a28ebb57d

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    1.0MB

    MD5

    efdf9c9f053e58c1ffe6d7065ef48a07

    SHA1

    2ca152df8ae58c8653a34184b6e3ab162491938d

    SHA256

    04a7efaae6f1479ba3c9e23bff682d1c4027cd5e43ba37edad54aa7a226ec4a7

    SHA512

    5ad33ff9ea07bb173efda787851f49b94c12f6ab9c10e122be6f65da8fe9f80f001f924e134039c5f86ef6e283aebba7533d5892ab6869f45a2e456ea68e0460

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

    Filesize

    463KB

    MD5

    ae3adedff3e1a458211b4fa0487e0cac

    SHA1

    e1bb832bb63b11d2627fe725dee17636cc08c95a

    SHA256

    995d8bf14412cbb737ebbfd01ff2faaa6195117e7b42bc3e569dd69b6af9069e

    SHA512

    07dcca09b47896428529bc4a4c3a7b9f20ab7482bacff7f3d12d73e785424d09c614f08da846ad5513da65381ba687846370f265a313dda830468ba7c413d13d

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

    Filesize

    600KB

    MD5

    d083ad56c00a414d7fceb5ed56ab91f5

    SHA1

    e1809bc555ce4e09396044f9c6d01c9ecc366988

    SHA256

    accbc54e91a542fd5cc73295ae59227b409af2e4f1cba533a0110155c7cb6c3a

    SHA512

    516249c81f9e2c1b37214eedfd2481b4ea265679869ec5415333285da8275431f7089453fa86009f8549dd01021f8f42db7163da45dac1b4dd31ae604f330449

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

    Filesize

    419KB

    MD5

    592966b4412e61282448daa7480ae4d8

    SHA1

    e04f2f46ff83959d8d2cdba77cf9a17d3918c678

    SHA256

    e03f1d81db5d969dd36531ba542fa966151a424fe25196e8b9824c8e0bf4b63f

    SHA512

    b06bae6b9744473bcfe5cd739cfcebc6e498cdf9f3954ab7ed1a638a1a1813756fa3fa0a94f7909e5e49160b2c119644894e8dba92d12a6e3fe8a02b5ca74f51

  • C:\Program Files\Google\Chrome\Application\RCX3711.tmp

    Filesize

    236KB

    MD5

    2a59cb4ece9148c8b19a42e42cf1279b

    SHA1

    ec1f3e0e4f109adfaa471667fad9ce3f76701679

    SHA256

    800b273a6410a3ff19dce8279b00b50235c9849ebf262e2b47cb88c25c9b12d8

    SHA512

    7eeef546cd3018913855889b017cc7810277952ba83a3deca3bd9fae997f4f010d7efbb3885514862a3f4ea5095b74d8606320c28dd7f2913d40cd5e1fe0744e

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    453KB

    MD5

    bca093dce2ad3c082695793a6e5777d7

    SHA1

    089fed0447e85fedab51b87ea5ae198aaf54ebff

    SHA256

    c8d792339fb896d9dfb43d7208f902b10f2f6ee663d791d9ada2f461e4cf758a

    SHA512

    26469f27ed5953f5dec90c399debc208a6cf0b89957279f69107e70b56ff9481e455b12119d0cb0c828b79071ad505c0fdbbf86db1f68d12e1a2381abd01587d

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    750KB

    MD5

    b505af26bfeca41ed528385108382a61

    SHA1

    f32f69fb8009df2d9c547562042e147c592e8c31

    SHA256

    8b141591fe355f5c474ef015ac92a4cc125f6a622cf4eff82c1b0527a14a49f9

    SHA512

    0b7f8d8eeccead07ac3935855143d3753881c688021986f5c4412af392e005b0e33d31193a12fbc30e9c8b1355dff854f7345a2073fadaf58806149ebaa1f2ad

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    534KB

    MD5

    8e776acb0f7a5da67d8b03da2a35decf

    SHA1

    d4b82b8ee02a2348775cdc3f1e12b6875277e345

    SHA256

    a4c8f64a3c0b8e9a2c49a0a3d30196cc850743118126a22fd370ed53326d6b23

    SHA512

    8d9fab69ef64aad58ab71b79a0392b06a6b1977260fd35ac748fec54a74953b163c69ad5abb114201cd9e9e034df79c0866308df88ccf277400c177feed36b70

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab

    Filesize

    23KB

    MD5

    f63d14c000dfcadf2394c737edaeaec9

    SHA1

    1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8

    SHA256

    ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29

    SHA512

    4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.cab

    Filesize

    23KB

    MD5

    952fc862806f000e37d22897243c2bc4

    SHA1

    2da507ba99d86deee0fed3238e5e9fb170a562d2

    SHA256

    955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee

    SHA512

    c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05

  • C:\Program Files\Java\jre-1.8\bin\RCX3856.tmp

    Filesize

    236KB

    MD5

    2b0b864d8c4579fef0b2847741dac018

    SHA1

    bc98c839834a64767b51501a76b7e40d30bb809e

    SHA256

    98bfa1980ce67c8befe80f23c893373898bad9d1b19d79a32c41b2c3b4300766

    SHA512

    89e01b207759d6db689834cba21d2bd5095c2b7feb949c89b29ea591208658aa7912a9f6a941747e7099d2296ea05bcc6d37046eb1b00493b845a8a76eada5d8

  • C:\Program Files\Java\jre-1.8\bin\jabswitch.cab

    Filesize

    44KB

    MD5

    f0f1575cb0a27c0815cd6a6ee694c7a1

    SHA1

    347aabf545b26e24293e7983a34a88fb1f132ed3

    SHA256

    7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae

    SHA512

    6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a

  • C:\Program Files\Java\jre-1.8\bin\java-rmi.cab

    Filesize

    23KB

    MD5

    5aab08e129caf5c4595f21142e3c32bd

    SHA1

    1ee57e2d3e4939945939d4df180c1f9128fb2582

    SHA256

    ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf

    SHA512

    5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d

  • C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab

    Filesize

    238KB

    MD5

    3f1c773a2e54f4d27b29c3fc1edd7d43

    SHA1

    ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185

    SHA256

    ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254

    SHA512

    d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297

  • C:\Program Files\Mozilla Firefox\crashreporter.cab

    Filesize

    262KB

    MD5

    73603c36b4d1522c3402d67ecf657312

    SHA1

    6a964ae5d681455c320ea0f8611b79a99a35b283

    SHA256

    7fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4

    SHA512

    5fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    296KB

    MD5

    845f8c8c27fbb92b172a584480316858

    SHA1

    e6f968e5d0b27b6912b27846cdf6b498a52de85a

    SHA256

    991531c04bad114c25cb07f139893b4e1faf0373c2b02421c2a2cf5cfa4c48e9

    SHA512

    a64ec6a3043b377768066c44e287285141e78f3c1fb667eab1ead5754c12b2c00cb303c23847d4ed497472855f3e0a9d0388188f689271b94adae92080ec13ba

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    425KB

    MD5

    daa3055cc499c8dad328bb65a4245e98

    SHA1

    70b09aeb5ea68277ad189a71a55b13b628030989

    SHA256

    ca476ee906743ce3c0082e4bf9366fc0b850d4030c22025fe9324326f1e3a213

    SHA512

    b70a97e425d60f80a10e77dca320a305cfed54971054f204317d09a3758012d1ab0856230e0c56ed0839f214db199f2a351bb4a929c4f0fdb3d5ddba0ef34cfd

  • C:\Program Files\dotnet\dotnet.cab

    Filesize

    138KB

    MD5

    b51fb63223915f23c60adc580c9a0531

    SHA1

    a22bf33ac2769c31c922c45f314b4d6e42ed77db

    SHA256

    b9eace03c8471717e3f98873527005dbd9a92367b954f8c48484d2b7b78efbac

    SHA512

    cd72aac2128c48c34568db1ac7b33e6934f31f473278426ef2acf9cd4df545dea8424bedf79340eb74a966ce39a3a7d9910fcbe456047d83330c62761644194d

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.cab

    Filesize

    56KB

    MD5

    48218aa6a473255fe6d47dcf3f0b7d6b

    SHA1

    65f9f03c3131da53389e3250a255eda418f18fc8

    SHA256

    76e459a20b870b91c42f525155ba94e8e2aa0ce82c4da46bdf2386321f6378b3

    SHA512

    bbf5edaf94bd8356dae4bfe63967c75044cf03c1844a67628f5b30e70a0d82dc74340466147614b48ffb48de25326bc28a2f366f776f9fb6bed98512aa275161