987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
Size

66KB
MD5

e13b4f85d7a1be04b99aff76d36e62d3
SHA1

6787ace84a0c4df2738fb2da7509f862c6a24fae
SHA256

987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f
SHA512

a27a1b088871aafd6d4f73285ee70c2585c5675761d12a2b35b91b72e8df4ec76a523be7f20d56dbaa51e9527d0890c639f1a69375ce2c08c0c1f449da877902
SSDEEP

768:bKSjMqQeL2QTLqhhg/qUjdD0tB18hGKPvAbhp8J+j05PoWCyZqlSmQBUjYQ:xjMqxL2Q3qOLjp01Y06JdOGZqlSmQBQ

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\P:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\L:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\E:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\K:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\I:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\Z:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\V:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\U:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\T:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\Q:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\Y:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\S:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\O:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\N:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\H:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\X:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\W:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\M:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\J:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened (read-only)	\??\G:	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WMPDMC.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{5CF72A45-AD68-472B-BBFF-38A947BD74EE}\chrome_installer.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2772	2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe	28
PID 2664 wrote to memory of 2772	2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe	28
PID 2664 wrote to memory of 2772	2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe	28
PID 2664 wrote to memory of 2772	2664	987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe	28
PID 2772 wrote to memory of 2440	2772	net.exe	30
PID 2772 wrote to memory of 2440	2772	net.exe	30
PID 2772 wrote to memory of 2440	2772	net.exe	30
PID 2772 wrote to memory of 2440	2772	net.exe	30

C:\Users\Admin\AppData\Local\Temp\987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe
"C:\Users\Admin\AppData\Local\Temp\987887182fd5ba7c2220a086762016de554dbedab9862a8e44502b5300dcac4f.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
610KB

MD5
2ffaa07fb02b63e75b3f5610eee470a8

SHA1
f170010826873a353f510283013b4c69a92f62ab

SHA256
ad23dd3530190aee7059f5a463d5b4bdee18760f5e17a6961fb59b16be251a38

SHA512
c93e6eb6c414f711a4e1e6867688ea83dc43ec2641054ed6b54c3970137fde7d251ae42f838b4b8edaaafae5024dff286a19cabfa051258dc7e3dadd80fab47a

Download Submit
memory/2664-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-143-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-218-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download