Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 23:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe
-
Size
108KB
-
MD5
863d3f148d38274b44a3af58b16eb685
-
SHA1
d8c3894f6afe7e9078ac0f8f42178e7680763c05
-
SHA256
70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218
-
SHA512
95a12612b33879d959ddc58c19db0ad34aa9324f785b86580ad399717a28a8978754c4aecc3b760dfd0a008820fd1c9c8e232bfe2da6d775a47a56388d4f58b7
-
SSDEEP
1536:HaiqH1s+kCtrA2UMT0mTFibDKa1AihYb7NMKT/rlJnx:q1B31bdBob2QAiENMKjhX
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0007000000014bea-7.dat INDICATOR_EXE_Packed_MPress behavioral1/files/0x0006000000016d26-71.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2512-94-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_MPress -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5C74.tmp 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5C53.tmp 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\sIRC4.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5C73.tmp 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 70b6ed6d84c20515131424d062280a6a736461dd53a2981e2f56c99a30293218.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5aa42d8980e5750941eabf338ae6e1467
SHA1f962ae910c33e68daff3064d5fe9f595744a0a63
SHA256f79ed89e3d630aa09e105a98a66aff8532b2caf3cdc0c00346912ab88e5cf4f8
SHA5126dbec3d3d91f267d3551ba50b9c193635e8200d8393f85512965399c5ac4ba04eb4b2f6ecd671977dab6193f2873435ca381acb696187dd353618f2055e0b5de
-
Filesize
684KB
MD5bb0bc8d373c3a38a48b5a2b9529b1751
SHA128bb705a8d024489ee4171933a9be62333afae31
SHA25690d0a92a93eb946e0989ac38223566c6fd960942c88cb8f55711f2de66206e20
SHA512903853b99449a58d4c210f2bf965c764f1af874d817917c8236a4d006adfeecf71f9fedbccd86446c4333da2bb2019f6b8a237a5debf6397398e0a296135734b