Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
b92f530c26439241d67e177dce8a0cf8.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b92f530c26439241d67e177dce8a0cf8.exe
Resource
win10v2004-20240226-en
General
-
Target
b92f530c26439241d67e177dce8a0cf8.exe
-
Size
327KB
-
MD5
b92f530c26439241d67e177dce8a0cf8
-
SHA1
b4231023d24e8ad7efb4c5aeb37c455e21e5b073
-
SHA256
206c3a864bd525d5fd95a328e8f6193a3e9429fbeacbe19023a5172a8d6e11e4
-
SHA512
a6fd8b03e53e2b982ad35de1c57407ecfc488bfb908fdafe701f2a058869b15e1abed832c76e810aac60591d6b96a2ab16fd5015709821495b1ec152339c9584
-
SSDEEP
3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBFH91p:L1XlKgzelZNQSBQGH/CSpWqTMmQA
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\J: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\K: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\M: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\O: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\G: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\H: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\I: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\L: b92f530c26439241d67e177dce8a0cf8.exe File opened (read-only) \??\N: b92f530c26439241d67e177dce8a0cf8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX388E.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\RCX3605.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\RCX3628.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3710.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3755.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3766.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX364A.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX370F.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX3789.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\dotnet\dotnet.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX37DD.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX37EE.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\dotnet\dotnet.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\dotnet\dotnet.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\dotnet\RCX366C.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX387B.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3832.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX3868.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\7-Zip\7z.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3767.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3833.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\7-Zip\7z.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX365B.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3732.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3768.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Internet Explorer\ieinstal.exe b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Internet Explorer\iexplore.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX3845.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCX37CD.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3821.tmp b92f530c26439241d67e177dce8a0cf8.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX387A.tmp b92f530c26439241d67e177dce8a0cf8.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe b92f530c26439241d67e177dce8a0cf8.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
380KB
MD5969f744c57c79dcfbe6404cbdb77d965
SHA1f39ccee7b0c9cba4e87118384df0422c8626546e
SHA2564c1d1da4228a01a7f5705f10975db9a857eb199fbd021503463a36e6f991b2bd
SHA5124722360f3f75b611468dbb19bd05b1d39cf33539aae12a526352785d84e9138e3b14029da38793649b9e1c8a406ae667247fd186b09a18d117cc64af15cc70b1
-
Filesize
520KB
MD5eaf8600298b8dcec6a02901af8fb08b5
SHA1a41b0b602d549112fe9ed9f51a6998d27bb8d0d4
SHA25662be5bbe3f9e007036cd3c152180001acac07d077cc3be3325258416d9330e1a
SHA512306999b6eb0813cd869d63600d593772d769e367da3d285a70eaf8d92c31fd146e954e37f9b3f6841d5181fa18a1e93763f42ddb62fec035afbd70d81c9db045
-
Filesize
281KB
MD53dc3594fb3b25c55081fe4b3226abbc2
SHA17eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA2566d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
SHA5128f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
-
Filesize
236KB
MD50d8626ee0ae4d13506e3d53ec0382a54
SHA1d4b055a326e93ed47934bdcbd11eb7850e691411
SHA256777bef9869479af587c36dced9cb7fb97e1dbc2b751c5c03c6bea4d70c192693
SHA51220c71c105d11878dcad6e646f64c7cbefbf134681292188b2e6774a36774c57248b9a45e8b76459545112aaa672e22af2f7b44e78b8ea712ddcc2e78b585d14a
-
Filesize
785KB
MD5d56d9539cff62f9227c689bbb0e175c6
SHA102835b85162ce9e47dd53fa918126bc78d57d0e4
SHA25687452a2c724f2ca88cc2c67ab1fec4cd3531d409384b2122cdfe5d78464fdd0f
SHA51235b0124e956141fd4bf124c08712117fffc66fd4ea3dbdd445e0f290057a5e6ba42ba616e31eb134c506f5ae29b64acb4f415d092b801683c5f8f78a28ebb57d
-
Filesize
1.0MB
MD5efdf9c9f053e58c1ffe6d7065ef48a07
SHA12ca152df8ae58c8653a34184b6e3ab162491938d
SHA25604a7efaae6f1479ba3c9e23bff682d1c4027cd5e43ba37edad54aa7a226ec4a7
SHA5125ad33ff9ea07bb173efda787851f49b94c12f6ab9c10e122be6f65da8fe9f80f001f924e134039c5f86ef6e283aebba7533d5892ab6869f45a2e456ea68e0460
-
Filesize
463KB
MD5ae3adedff3e1a458211b4fa0487e0cac
SHA1e1bb832bb63b11d2627fe725dee17636cc08c95a
SHA256995d8bf14412cbb737ebbfd01ff2faaa6195117e7b42bc3e569dd69b6af9069e
SHA51207dcca09b47896428529bc4a4c3a7b9f20ab7482bacff7f3d12d73e785424d09c614f08da846ad5513da65381ba687846370f265a313dda830468ba7c413d13d
-
Filesize
600KB
MD5d083ad56c00a414d7fceb5ed56ab91f5
SHA1e1809bc555ce4e09396044f9c6d01c9ecc366988
SHA256accbc54e91a542fd5cc73295ae59227b409af2e4f1cba533a0110155c7cb6c3a
SHA512516249c81f9e2c1b37214eedfd2481b4ea265679869ec5415333285da8275431f7089453fa86009f8549dd01021f8f42db7163da45dac1b4dd31ae604f330449
-
Filesize
419KB
MD5592966b4412e61282448daa7480ae4d8
SHA1e04f2f46ff83959d8d2cdba77cf9a17d3918c678
SHA256e03f1d81db5d969dd36531ba542fa966151a424fe25196e8b9824c8e0bf4b63f
SHA512b06bae6b9744473bcfe5cd739cfcebc6e498cdf9f3954ab7ed1a638a1a1813756fa3fa0a94f7909e5e49160b2c119644894e8dba92d12a6e3fe8a02b5ca74f51
-
Filesize
236KB
MD52a59cb4ece9148c8b19a42e42cf1279b
SHA1ec1f3e0e4f109adfaa471667fad9ce3f76701679
SHA256800b273a6410a3ff19dce8279b00b50235c9849ebf262e2b47cb88c25c9b12d8
SHA5127eeef546cd3018913855889b017cc7810277952ba83a3deca3bd9fae997f4f010d7efbb3885514862a3f4ea5095b74d8606320c28dd7f2913d40cd5e1fe0744e
-
Filesize
453KB
MD5bca093dce2ad3c082695793a6e5777d7
SHA1089fed0447e85fedab51b87ea5ae198aaf54ebff
SHA256c8d792339fb896d9dfb43d7208f902b10f2f6ee663d791d9ada2f461e4cf758a
SHA51226469f27ed5953f5dec90c399debc208a6cf0b89957279f69107e70b56ff9481e455b12119d0cb0c828b79071ad505c0fdbbf86db1f68d12e1a2381abd01587d
-
Filesize
750KB
MD5b505af26bfeca41ed528385108382a61
SHA1f32f69fb8009df2d9c547562042e147c592e8c31
SHA2568b141591fe355f5c474ef015ac92a4cc125f6a622cf4eff82c1b0527a14a49f9
SHA5120b7f8d8eeccead07ac3935855143d3753881c688021986f5c4412af392e005b0e33d31193a12fbc30e9c8b1355dff854f7345a2073fadaf58806149ebaa1f2ad
-
Filesize
534KB
MD58e776acb0f7a5da67d8b03da2a35decf
SHA1d4b82b8ee02a2348775cdc3f1e12b6875277e345
SHA256a4c8f64a3c0b8e9a2c49a0a3d30196cc850743118126a22fd370ed53326d6b23
SHA5128d9fab69ef64aad58ab71b79a0392b06a6b1977260fd35ac748fec54a74953b163c69ad5abb114201cd9e9e034df79c0866308df88ccf277400c177feed36b70
-
Filesize
23KB
MD5f63d14c000dfcadf2394c737edaeaec9
SHA11c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8
SHA256ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
SHA5124cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053
-
Filesize
23KB
MD5952fc862806f000e37d22897243c2bc4
SHA12da507ba99d86deee0fed3238e5e9fb170a562d2
SHA256955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
SHA512c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05
-
Filesize
236KB
MD52b0b864d8c4579fef0b2847741dac018
SHA1bc98c839834a64767b51501a76b7e40d30bb809e
SHA25698bfa1980ce67c8befe80f23c893373898bad9d1b19d79a32c41b2c3b4300766
SHA51289e01b207759d6db689834cba21d2bd5095c2b7feb949c89b29ea591208658aa7912a9f6a941747e7099d2296ea05bcc6d37046eb1b00493b845a8a76eada5d8
-
Filesize
44KB
MD5f0f1575cb0a27c0815cd6a6ee694c7a1
SHA1347aabf545b26e24293e7983a34a88fb1f132ed3
SHA2567f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
SHA5126713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a
-
Filesize
23KB
MD55aab08e129caf5c4595f21142e3c32bd
SHA11ee57e2d3e4939945939d4df180c1f9128fb2582
SHA256ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
SHA5125b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d
-
Filesize
238KB
MD53f1c773a2e54f4d27b29c3fc1edd7d43
SHA1ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185
SHA256ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
SHA512d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297
-
Filesize
262KB
MD573603c36b4d1522c3402d67ecf657312
SHA16a964ae5d681455c320ea0f8611b79a99a35b283
SHA2567fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4
SHA5125fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238
-
Filesize
296KB
MD5845f8c8c27fbb92b172a584480316858
SHA1e6f968e5d0b27b6912b27846cdf6b498a52de85a
SHA256991531c04bad114c25cb07f139893b4e1faf0373c2b02421c2a2cf5cfa4c48e9
SHA512a64ec6a3043b377768066c44e287285141e78f3c1fb667eab1ead5754c12b2c00cb303c23847d4ed497472855f3e0a9d0388188f689271b94adae92080ec13ba
-
Filesize
425KB
MD5daa3055cc499c8dad328bb65a4245e98
SHA170b09aeb5ea68277ad189a71a55b13b628030989
SHA256ca476ee906743ce3c0082e4bf9366fc0b850d4030c22025fe9324326f1e3a213
SHA512b70a97e425d60f80a10e77dca320a305cfed54971054f204317d09a3758012d1ab0856230e0c56ed0839f214db199f2a351bb4a929c4f0fdb3d5ddba0ef34cfd
-
Filesize
138KB
MD5b51fb63223915f23c60adc580c9a0531
SHA1a22bf33ac2769c31c922c45f314b4d6e42ed77db
SHA256b9eace03c8471717e3f98873527005dbd9a92367b954f8c48484d2b7b78efbac
SHA512cd72aac2128c48c34568db1ac7b33e6934f31f473278426ef2acf9cd4df545dea8424bedf79340eb74a966ce39a3a7d9910fcbe456047d83330c62761644194d
-
Filesize
56KB
MD548218aa6a473255fe6d47dcf3f0b7d6b
SHA165f9f03c3131da53389e3250a255eda418f18fc8
SHA25676e459a20b870b91c42f525155ba94e8e2aa0ce82c4da46bdf2386321f6378b3
SHA512bbf5edaf94bd8356dae4bfe63967c75044cf03c1844a67628f5b30e70a0d82dc74340466147614b48ffb48de25326bc28a2f366f776f9fb6bed98512aa275161