Analysis

  • max time kernel
    119s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 18:01

General

  • Target

    1fd09aeee921b27f58416bccc70fafb59eafc7ac5f4909852b1d53a9cbc96795.exe

  • Size

    288KB

  • MD5

    d2765e0653ee1619e78c9ab02b1b13ef

  • SHA1

    9b7535e4419959d4f3422134b434339ca11f4201

  • SHA256

    1fd09aeee921b27f58416bccc70fafb59eafc7ac5f4909852b1d53a9cbc96795

  • SHA512

    02912c4c843e1244ae70ba9846baf798fa093cdd3214c6be5275594c5acf8a4df3dfdb9d4d172cf99f50a9a33d564742854f2da705aac3bd5653f4c1b8d49a2f

  • SSDEEP

    3072:nZUWlN3tGXRvjxCb5NgXDY7uSK4aqTBrgmQ+l9pO:ZFAlKgzeYqTKmQgO

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd09aeee921b27f58416bccc70fafb59eafc7ac5f4909852b1d53a9cbc96795.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd09aeee921b27f58416bccc70fafb59eafc7ac5f4909852b1d53a9cbc96795.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    544KB

    MD5

    9a1dd1d96481d61934dcc2d568971d06

    SHA1

    f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

    SHA256

    8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

    SHA512

    7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    331KB

    MD5

    7f9216d82b3110d32023c564d94d6115

    SHA1

    be0c05708f9c1dd9b76c041b2117e0c428039fed

    SHA256

    aef37c2d3736cb45e219b1ffcd33ec20b63548a80940841e6e9b5d77187ff61c

    SHA512

    8950fb0c28b28eb93f0d459638c8094b04d5e8d49958bce0bc5b7db657922324aee61be19f16a4db0b50a85b47c788d7853e4264c99dbc38fda11816837386c2

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    930KB

    MD5

    30ac0b832d75598fb3ec37b6f2a8c86a

    SHA1

    6f47dbfd6ff36df7ba581a4cef024da527dc3046

    SHA256

    1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

    SHA512

    505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

    Filesize

    308KB

    MD5

    549efa48b8c994b056ed31743d626d2c

    SHA1

    0439e6a072d00b2a528dad68830d96bc99124c25

    SHA256

    97183c12e7eb2fed5fc32c15b78624d13df89e428623bc22adb7f88be3e6e87e

    SHA512

    1dd5007ce2dc7f0c17975ae667a7929697c129b51c6bcc16df280930636ceb5860a7886233957e5d418370cedec7ba3c45d86316a346c741cef89a31f9ab844a

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

    Filesize

    118KB

    MD5

    f45a7db6aec433fd579774dfdb3eaa89

    SHA1

    2f8773cc2b720143776a0909d19b98c4954b39cc

    SHA256

    2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

    SHA512

    03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX77D5.tmp

    Filesize

    228KB

    MD5

    51f3035b62d61be815527e22ef9677da

    SHA1

    2d0b7e7802189331a6e4d292e13ad69eea1c415a

    SHA256

    f3108197f3db1ec6a28723118ac8669d542b7dfe4f4718b4f9c430cae0521b13

    SHA512

    825442c43cdd07ef4ac450158c103d75f5533e0c4d13859eb9dc25e72621d7cfd815fd0040f4be4639af808bd88e228c013acb255b4368c71941c3fee3792c39

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab

    Filesize

    2.1MB

    MD5

    c38e48265c3518a8c0b1538c502b467c

    SHA1

    36588c09ad050c179fa0753457e66b9b04620281

    SHA256

    2536ca87292ba577485e510a67cbfdb163dec1ac289fea6a908a68a22e140aa4

    SHA512

    1f5326623406281d993c84f3c72deb74c99b06a36391b88db100b8417d7c9def7d10873434e7099b4925b227b313935c3d322e4f66c978e62e6f0ee736f42a91

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

    Filesize

    1.6MB

    MD5

    527e039ba9add8a7fac3a6bc30a6d476

    SHA1

    729a329265eda72cada039c1941e7c672addfc19

    SHA256

    4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94

    SHA512

    9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

    Filesize

    1.6MB

    MD5

    ec6386b63c3a5ffe0577905e94262c3a

    SHA1

    8f8c428d0e7f32c9d733ca28384ded413a060588

    SHA256

    302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4

    SHA512

    ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    2.8MB

    MD5

    095092f4e746810c5829038d48afd55a

    SHA1

    246eb3d41194dddc826049bbafeb6fc522ec044a

    SHA256

    2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

    SHA512

    7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    236KB

    MD5

    6d06313d28f7c8025d67d8173dbb27c9

    SHA1

    a6c23caa828e3d5125ce67d3b8587a77ea6ad8e1

    SHA256

    aac8e8d989e1acbcb9cb5c6dd2c15a5adfad98ee22e70bbe6a64966fcfd27441

    SHA512

    a68a922f60e971809d6bd0e47a99e31a1c26737bc71b961d71d3165693949da76127624581646896b533fd07e0233109b3c589cc26bf35a7d771ab18ec1b4e48

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    1020KB

    MD5

    b65d7344b0a7faa207d2e1a7adaafb60

    SHA1

    755ad15b1745b0e730d658d4a92e2b754425b7db

    SHA256

    f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92

    SHA512

    f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

  • C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.cab

    Filesize

    15KB

    MD5

    c9aaf1247944e0928d6a7eae35e8cdc4

    SHA1

    af91d57336d495bb220d8f72dcf59f34f5998fd3

    SHA256

    05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

    SHA512

    bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

  • C:\Program Files\Java\jdk1.7.0_80\bin\apt.cab

    Filesize

    15KB

    MD5

    407d2d7dab36cdea871d4c6b9c62b258

    SHA1

    86cd158ad810c6772c22a5799c7acf4b9d7c9f57

    SHA256

    3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

    SHA512

    dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

  • C:\Program Files\Java\jre7\bin\jabswitch.cab

    Filesize

    54KB

    MD5

    e795eb03297dd66d2efac2c33920a69f

    SHA1

    bf41799164d6ab2690c39afa458122ed82f2d0a8

    SHA256

    133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

    SHA512

    6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

  • C:\Program Files\Java\jre7\bin\java-rmi.cab

    Filesize

    15KB

    MD5

    d3827115574d8b0ecbaeb03528c6d1a4

    SHA1

    2733607537ffc00e038039af7eba24601db6fbeb

    SHA256

    6ad5b065b3f612d89127b89033aaaff995942187f917144dbe28e656c3ba348f

    SHA512

    2a1f131960f452d1012a43597f2ac9df0edc22b6aa68fd52eabf4a4249d86c7776d625e00e7c5dbd4f35add9e31cbc02674be40714f9aa5f3a2f458419303c18

  • C:\Program Files\Microsoft Games\Chess\Chess.cab

    Filesize

    384KB

    MD5

    b5001da4301db54d1e2983715d45804a

    SHA1

    1bcc5ba7421104689301532975e91255ea2d0e9f

    SHA256

    8ead0b481edcb7a966441df7ca65523ed30319477c5b7a1ea2fa7a41923a9364

    SHA512

    b849d51d5dc4c1cf94b6001a425fcbac02f62ca702aa631c006255d6dc3e4b8ddec9d12c50bc279ce37caaeb349517b8d790343be5032e6a0d145b444268e877

  • C:\Program Files\Microsoft Office\Office14\MSOHTMED.cab

    Filesize

    64KB

    MD5

    4f5781ae5eced27efafa716c6a98e3c0

    SHA1

    6d9531e9090b73ae97f1156c1ef80b21687b9ffb

    SHA256

    c9208df2f67d47802469721a3082519d5114793dd7b5eefdf0b49db24ff04f1b

    SHA512

    427e3b506c3211b94d5c4738bd90e359b53cf2bc8ae20e86976ffa8eeb21734d7edd27187916612371d437a6288708e560e8a4f75e07d4a40554146fa04b0e9b

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    697KB

    MD5

    3fa2910cbd44b17be47ff26ef27c5157

    SHA1

    d8a2bbcd3c88671b48478db293c61268fc24accf

    SHA256

    d448206c75c51f8a44a1c7fd5dabb8b0505f670ecb2e5d2adf55791b9cef1b0c

    SHA512

    16b70c679db2ba74a98f99956984fa044e96c821ccd5521b4882134c705b823674891d0521dc49c2391d5c184bbbd0c6d68890df65aad1972113aeda4f3b944a

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    1.2MB

    MD5

    d358e785b13cdb7846b3ec8b74c3ce43

    SHA1

    8581ec4bcd412733f64ed547b7b63bfec0caab7d

    SHA256

    3cdb1c6e5f4a607bc310b745d551b59eca0aac02cb83da146bedc52aa05a6beb

    SHA512

    451a4a6003d1ca1de98ea291537ca793621e4e23a75fa39e05320737bcd6bb4242d4fefa4c7458399fb54a5414635c3f67c8972377183b289fbb05aa13c91629

  • C:\Program Files\VideoLAN\VLC\uninstall.cab

    Filesize

    228KB

    MD5

    5ba8b6e3a9d08a4fd4f71eed8cc56275

    SHA1

    5bfd77c8ddbca1dd2d4e6a9e08a0d89b50a654d0

    SHA256

    e202657abb97ac953185c97f0d4e3d3133fe760d8b8c4e97a2c53d94bb8d58e2

    SHA512

    e8242d974ff4c103cc1af4d44e55070abca619dfbae0fe450fb2dbe165a0af629c5e010bc0cbc5d7a8d40a2c420aacb3857f4d410f65235da8099379458fe419

  • C:\Program Files\VideoLAN\VLC\vlc-cache-gen.cab

    Filesize

    137KB

    MD5

    b2bf2621b184914d48bb147d38f64392

    SHA1

    b733404cf4231a069d47ca68b88118ddf05b18e0

    SHA256

    276c5e546732a7b5585670943c84fe4ea782a601ad54ad4248605ad4ee916210

    SHA512

    2966c8222af45c16c38a8341036ee58f65463d9874cc871639760b395cd8a3252e962b347e4b27c3aaf5735caeb5fc3154a29092d686642b66b49682662a168a