b6c1526b45d5591758b1f58873be29e22e7ca49952c66b279981f5c35596e8ad

Analysis

max time kernel
165s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7079debc3c25795f0c204a429faa659.exe
Size

1.7MB
MD5

c7079debc3c25795f0c204a429faa659
SHA1

c072f7829f250271a8e54130524def6a42042756
SHA256

b6c1526b45d5591758b1f58873be29e22e7ca49952c66b279981f5c35596e8ad
SHA512

2e53ef051b63231564823e5a1dd018b3248b9c3c5c2516339427117f980b749e1225ac99c90eab6c1ff9659d519893a0fd26c25c2f84d0e0237c0dac79412253
SSDEEP

24576:X8uIXVav9MkSlYjboGxZqwijaahIJpX6x/WnSyhbzv8O0X:L9v9MzlYvoGxUSJpXKWSytLdu

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	c7079debc3c25795f0c204a429faa659.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	c7079debc3c25795f0c204a429faa659.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	c7079debc3c25795f0c204a429faa659.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	c7079debc3c25795f0c204a429faa659.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	c7079debc3c25795f0c204a429faa659.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	c7079debc3c25795f0c204a429faa659.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	c7079debc3c25795f0c204a429faa659.exe

C:\Users\Admin\AppData\Local\Temp\c7079debc3c25795f0c204a429faa659.exe
"C:\Users\Admin\AppData\Local\Temp\c7079debc3c25795f0c204a429faa659.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$

Filesize
1.7MB

MD5
c7079debc3c25795f0c204a429faa659

SHA1
c072f7829f250271a8e54130524def6a42042756

SHA256
b6c1526b45d5591758b1f58873be29e22e7ca49952c66b279981f5c35596e8ad

SHA512
2e53ef051b63231564823e5a1dd018b3248b9c3c5c2516339427117f980b749e1225ac99c90eab6c1ff9659d519893a0fd26c25c2f84d0e0237c0dac79412253

Download Submit
memory/1588-1-0x00000000004A0000-0x00000000004A3000-memory.dmp

Filesize
12KB

Download
memory/1588-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1588-77-0x00000000004A0000-0x00000000004A3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads