Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/04/2024, 21:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe
- Size 5.9MB
- Sample240406-z63ddaca44
- SHA256 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8
- MD5 7feb4021697bc40cc68509a73a79ef88
- SHA1 eb8aae23a2ab6de17b35b6982b9da536a1468619
- SHA512 027298bdf84dceac4862517833b77e0ea52dcdcd8072d17fff0ab57057fe6f34fde11ca7661293c2259d1271cdbf6024f2307aa6e79ffb6e9bfc9b4cff8e9dc2
- SSDEEP 98304:dG6q0HqBQgN71haEmfJ7vl003/VfBtaiq2KveJddj8J7Em9S7MxWBvEe0aRKCeAf:A6q0HkQgN1DmfJLO03/Vnaiq2L8dET6u
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX98F8.tmp 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\MavInject32.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9665.tmp 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\sIRC4.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX97FD.tmp 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX9616.tmp 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4136 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe 4136 58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe"C:\Users\Admin\AppData\Local\Temp\58fda8ce01bc1093b238a246859c63ae62fa4da8344863e26301f6c6c9e735e8.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\RCX9665.tmp
- Size 5.9MB
- SHA256 e9fbec5209aa746c6e2a8044172133668eaad214371617ab0dcbc3787b4892b8
- MD5 4d98dcee1bfaee6b1e48efad371af4b8
- SHA1 dfaf735d8c50c621ef974f9b3f27d85ed24c649d
- SHA512 19c4fdab3737e58a8a778ca5514db7e85cc1c15080644707b9e345ea5a4f2ed43891fc994b059adb2ea74e4737e5c25cc2285a6392fd2ecf355197712f312897
- SSDEEP 98304:TG6q0HqBQgN71haEmfJ7vl003/VfBtaiq2KveJddj8J7Em9S7MxWBvEe0aRKCeAr:y6q0HkQgN1DmfJLO03/Vnaiq2L8dET6w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xdccPrograms\7zFM.exe
- Size 5.9MB
- SHA256 5bd2c9499e456612864a84e3b9b254ffc9851d1b0278ecfafa83bf36e4601df9
- MD5 2f3bc402edb2ca49de89ee932422d9c8
- SHA1 540a51726418ec982c688378e95d1a97190eb2ba
- SHA512 63742d82fcbea8dacf46d61ea72846610609c410deae9c42f0260c05f76ad6abdc9743afbabfadbf31a961bf70f5c7fc82e37ba2c977b0110b73a83138cbb711
- SSDEEP 98304:dG6q0HqBQgN71haEmfJ7vl003/VfBtaiq2KveJddj8J7Em9S7MxWBvEe0aRKCeAo:A6q0HkQgN1DmfJLO03/Vnaiq2L8dET65
- MD5 SHA1 SHA512 SSDEEP