Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 20:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e246c9e9cb0aa807703e6d696b0294ac.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e246c9e9cb0aa807703e6d696b0294ac.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
e246c9e9cb0aa807703e6d696b0294ac.exe
-
Size
145KB
-
MD5
e246c9e9cb0aa807703e6d696b0294ac
-
SHA1
8e5526009704617c52df9cf348859878889e6a2f
-
SHA256
63a5c0e2156eef987a9e3938b1a297769df726936bcd995435d9deb09daba779
-
SHA512
ab6a3b6b3ce3327184f2f0b50a218d197cc7dc192f97f77547416ba17fd2eba8d70490bbc30498af315f7d570445e58bd97c50ca480e4d7930fd89faddd4bcac
-
SSDEEP
3072:jdozRNCZ/NzgPWD2+SRleqQ4NPEEUqob/lnMMMMMMjMMMMMMMMMMMHMMMMMMbMMy:i3CUWERVQ4NeqoVMMMMMMjMMMMMMMMM9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2492 msadcermsadcfr.exe 1832 systemmicrosoft.exe 1644 windowsoperating.exe 980 sqloledboledb32r.exe -
Loads dropped DLL 20 IoCs
pid Process 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e246c9e9cb0aa807703e6d696b0294ac.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\SoftWaresdffdfc = "c:\\program files (x86)\\common files\\system\\msadc\\ja-jp\\msadcermsadcfr.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SoftWaresdffdfc = "c:\\program files (x86)\\common files\\system\\ole db\\de-de\\sqloledboledb32r.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e246c9e9cb0aa807703e6d696b0294ac.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sdffdfcSoftWare = "c:\\program files (x86)\\windows defender\\ja-jp\\windowsoperating.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\sdffdfcServices = "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msolui100dialog.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Naturalmsgr3en = "c:\\program files (x86)\\microsoft office\\office14\\proof\\1033\\languagecomponents.exe" e246c9e9cb0aa807703e6d696b0294ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\sdffdfcSoftWare1.2.8800.0 = "c:\\program files (x86)\\windows nt\\tabletextservice\\en-us\\systemmicrosoft.exe" e246c9e9cb0aa807703e6d696b0294ac.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll windowsoperating.exe File created C:\Windows\SysWOW64\ntdll.dll.dll sqloledboledb32r.exe File created C:\Windows\SysWOW64\ntdll.dll.dll e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Windows\SysWOW64\ntdll.dll.dll msadcermsadcfr.exe File created C:\Windows\SysWOW64\ntdll.dll.dll systemmicrosoft.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqloledboledb32r.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcermsadcfr.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\WindowsOperating.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\SystemMicrosoft.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100Dialog.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\LanguageComponents.exe e246c9e9cb0aa807703e6d696b0294ac.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqloledboledb32r.exe e246c9e9cb0aa807703e6d696b0294ac.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 1960 e246c9e9cb0aa807703e6d696b0294ac.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2492 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 29 PID 1960 wrote to memory of 2492 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 29 PID 1960 wrote to memory of 2492 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 29 PID 1960 wrote to memory of 2492 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 29 PID 1960 wrote to memory of 1832 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 30 PID 1960 wrote to memory of 1832 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 30 PID 1960 wrote to memory of 1832 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 30 PID 1960 wrote to memory of 1832 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 30 PID 1960 wrote to memory of 1644 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 31 PID 1960 wrote to memory of 1644 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 31 PID 1960 wrote to memory of 1644 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 31 PID 1960 wrote to memory of 1644 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 31 PID 1960 wrote to memory of 980 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 32 PID 1960 wrote to memory of 980 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 32 PID 1960 wrote to memory of 980 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 32 PID 1960 wrote to memory of 980 1960 e246c9e9cb0aa807703e6d696b0294ac.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e246c9e9cb0aa807703e6d696b0294ac.exe"C:\Users\Admin\AppData\Local\Temp\e246c9e9cb0aa807703e6d696b0294ac.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\program files (x86)\common files\system\msadc\ja-jp\msadcermsadcfr.exe"c:\program files (x86)\common files\system\msadc\ja-jp\msadcermsadcfr.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492
-
-
\??\c:\program files (x86)\windows nt\tabletextservice\en-us\systemmicrosoft.exe"c:\program files (x86)\windows nt\tabletextservice\en-us\systemmicrosoft.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832
-
-
\??\c:\program files (x86)\windows defender\ja-jp\windowsoperating.exe"c:\program files (x86)\windows defender\ja-jp\windowsoperating.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1644
-
-
\??\c:\program files (x86)\common files\system\ole db\de-de\sqloledboledb32r.exe"c:\program files (x86)\common files\system\ole db\de-de\sqloledboledb32r.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5e246c9e9cb0aa807703e6d696b0294ac
SHA18e5526009704617c52df9cf348859878889e6a2f
SHA25663a5c0e2156eef987a9e3938b1a297769df726936bcd995435d9deb09daba779
SHA512ab6a3b6b3ce3327184f2f0b50a218d197cc7dc192f97f77547416ba17fd2eba8d70490bbc30498af315f7d570445e58bd97c50ca480e4d7930fd89faddd4bcac