Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:17
Static task
static1
Behavioral task
behavioral1
Sample
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe
Resource
win10v2004-20240426-en
General
-
Target
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe
-
Size
188KB
-
MD5
a2dc35967f1bf9fa2d5cce36c9c75097
-
SHA1
294d883c6c95c3021810031d0a4f72fe2ca2d7f5
-
SHA256
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b
-
SHA512
f05922f9ee84dead9ce3335114774e9dc5f065566547d2b9403d43f7fb95ba85f08bca918a1a9a0a2977a533e9f1fcc39214cc7a9c2df72dfc3ce134325cec90
-
SSDEEP
3072:JFg1IB4T8Kzqw69Qdh9muTJBk1TpaQpAaF6ynXOAg0Fuj0YTjCU2dyGCH:JayBqLqbYh9D2rdpAjAOn/L2dT
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\CmzxHv.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
CmzxHv.exepid process 2516 CmzxHv.exe -
Loads dropped DLL 2 IoCs
Processes:
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exepid process 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
CmzxHv.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe CmzxHv.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe CmzxHv.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe CmzxHv.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe CmzxHv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe CmzxHv.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE CmzxHv.exe File opened for modification C:\Program Files\7-Zip\7zG.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE CmzxHv.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe CmzxHv.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe CmzxHv.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE CmzxHv.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe CmzxHv.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe CmzxHv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe CmzxHv.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe CmzxHv.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe CmzxHv.exe File opened for modification C:\Program Files\Windows Mail\wab.exe CmzxHv.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe CmzxHv.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe CmzxHv.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe CmzxHv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe CmzxHv.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe CmzxHv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exeCmzxHv.exedescription pid process target process PID 1728 wrote to memory of 2516 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe CmzxHv.exe PID 1728 wrote to memory of 2516 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe CmzxHv.exe PID 1728 wrote to memory of 2516 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe CmzxHv.exe PID 1728 wrote to memory of 2516 1728 09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe CmzxHv.exe PID 2516 wrote to memory of 2928 2516 CmzxHv.exe cmd.exe PID 2516 wrote to memory of 2928 2516 CmzxHv.exe cmd.exe PID 2516 wrote to memory of 2928 2516 CmzxHv.exe cmd.exe PID 2516 wrote to memory of 2928 2516 CmzxHv.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe"C:\Users\Admin\AppData\Local\Temp\09aa63833de2e821a439fa990b2f6654528820fa80847d4d1e6993b2951b308b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CmzxHv.exeC:\Users\Admin\AppData\Local\Temp\CmzxHv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\22fd2112.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22fd2112.batFilesize
187B
MD5b0132c8ccdda2ced0d5c0aeebc2f9d6f
SHA1bef9c09a2261948b0e574f26ca8baa33449d21ef
SHA256c5e72afb38926d4877807b35395e578ad46772d066221369342031e917ba3394
SHA51217e8cd7f80fc4e423bd74b334c15375a4190968afb5900af3e93c2603e4ae570c6c7fca4c03cf02a1c9c31b08f9e3bff4a89969bc261788ff46f67a795a091f5
-
C:\Users\Admin\AppData\Local\Temp\CmzxHv.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/1728-1-0x00000000011F0000-0x0000000001224000-memory.dmpFilesize
208KB
-
memory/1728-8-0x00000000011F0000-0x0000000001224000-memory.dmpFilesize
208KB
-
memory/2516-11-0x0000000001140000-0x0000000001149000-memory.dmpFilesize
36KB
-
memory/2516-29-0x0000000001140000-0x0000000001149000-memory.dmpFilesize
36KB