Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 21:18
Behavioral task
behavioral1
Sample
7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe
-
Size
847KB
-
MD5
4945e50c782812a90e8dfd20bded03da
-
SHA1
395df2e42ff9ee87935248241a1b71c8eec0345d
-
SHA256
7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a
-
SHA512
f0a75eba7a1f0c326b211a7a7e03d482a32c6e068f155a11dce49b58a97c727705d7ab3f6a858805523727f939a3338a677710bdb01fde9dba9e28d9216cceec
-
SSDEEP
24576:hi0/GNd0pnDznMVN6OLNMYGdTKeaAL7jqoO7:U0es/nMVI/dTp7s
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe -
UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/files/0x0007000000015c7b-7.dat UPX behavioral1/memory/1732-40-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-52-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/files/0x00060000000185eb-71.dat UPX behavioral1/memory/1732-107-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-108-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-109-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-110-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-111-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-112-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-113-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-114-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-115-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-116-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-117-0x0000000000400000-0x000000000041A000-memory.dmp UPX behavioral1/memory/1732-118-0x0000000000400000-0x000000000041A000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/files/0x0007000000015c7b-7.dat upx behavioral1/memory/1732-40-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-52-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/files/0x00060000000185eb-71.dat upx behavioral1/memory/1732-107-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-108-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-109-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-110-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-111-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-112-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-113-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-114-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-115-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-116-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-117-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1732-118-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX99E1.tmp 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX99A2.tmp 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9943.tmp 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9A01.tmp 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9A41.tmp 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 7355d97e64944942e756f007bbed6dfbb0d4034b1d02f2effda9d1b55c11028a.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5e544e15f5378ae0b0295a222ac68451d
SHA149acbe0b5c44bc25d6d3f845239c9a944c076941
SHA2568ff705dfb9e71f74039204745cd13099469acf51fdec878979886b1f0a222688
SHA5121d8f3aa65fc24449b57937a0c2f3f013ae9a625478035579fa5e24b2787f204a2e9adb3a0d3809fd2793502b88dff274b0a719ba6544fdc7e65dd640ecc99656
-
Filesize
859KB
MD55690d3406600076a56ae168bac21a0f4
SHA17733144de34014355b099251a784a2581a1d5689
SHA256c41fc45476a9b70f8455d5e5df83208002f769a6efee9bcfcd47b31356a947fc
SHA5127541ab3ce3775d2f30225f2a1b6cc974d7b83b31eaa7f656e766eac6699154ef1dc54b2c3c6ded1c5183a9f9548848d42161e571ff28a65e36ddfe51310ecea0