Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe
-
Size
1.1MB
-
MD5
28da96365513f4cc6ed583a7f2cbe83a
-
SHA1
f681e6c3f0d26ebe4932230fc5a669295334ce38
-
SHA256
1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464
-
SHA512
5f53b74f10468ffc0e5de95293f8e04af64ff41154663015098a4ea4a666f4d3f625f120c3ddf7411d6508011e6609dc9944b3ad963a1431d76cc41949be8ee6
-
SSDEEP
24576:DxWVeyRYdwzYDteYIpLW4O8b8ITDnlzeqrs:D8YYW4O8b8ITDnlzeqw
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe" 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe" 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe -
Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\setupexeMicrosoft.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\RCX615A.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\AdobeNPPDF32.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\OfficeWord.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcefModule.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\setupexeMicrosoft.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX7EC9.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX9B7E.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXABDB.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\Microsoftminiinstaller122.0.2365.52.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\Modulewidevinecdm.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\RCX562C.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TabTip32Microsoft10.0.19041.1.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Explorersqlite19.10.20064.310990.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\RCX45BE.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\RCX6E1D.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\RCX7F28.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\datamatrixpmpqrcodepmp.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCXAC98.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\RCX5417.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\RCX5F45.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeAdobeARM.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\RCX8061.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcefModule.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAiod.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AdobeMake.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCX9999.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\IEXPLOREInternet.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\RCX604F.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\RCX6F37.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\RCX74C6.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX93AC.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAcrobat.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Explorersqlite19.10.20064.310990.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXA95A.tmp 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\SystemMicrosoft10.0.19041.746.160101.0800.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeAdobeARM.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\IEXPLOREInternet.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\Microsoftminiinstaller122.0.2365.52.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\StudioVisual7.00.9466.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\MicrosoftMicrosoft.exe 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe 2620 1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe"C:\Users\Admin\AppData\Local\Temp\1fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5deade58ca91aab0ff839d640bcdbe905
SHA13d0dcef9f649e878ce92021aaf8ac45e148287a2
SHA25631a461204c0bfbb3fbe7ef810889056dea089695862a6639caddbdde6b0b275c
SHA51280d5e3dbc5f78d5ebcf5677f5eb3b23015e0cbc085a5b9aaf67910d816e562acfa93f8c6dbc7041243fcf667270578f012d380fc9038d9ee95f61221dc58b3d1
-
Filesize
1.1MB
MD5f819b68c777208eb02c790b5d1db3144
SHA15150b35a6c9fef7a699e3b076b6410d242fc12b7
SHA25638455eab877bc332e121fd3ac9829fefbedebaaad0f08dd24c663ddc76b2d678
SHA5120a2e433327c3f12f847a4fc9ffd2d680cc5828e5dba03ab7044142cbeb527c52f8f23c0dba52f5ece915c31b7551633fe93958b04aafaaaea7f037ccba3f46a3
-
Filesize
1.1MB
MD528da96365513f4cc6ed583a7f2cbe83a
SHA1f681e6c3f0d26ebe4932230fc5a669295334ce38
SHA2561fb5f8faa1252bb5d6d4ab9013916b8bfab391b7e83c334cbec57876dd14b464
SHA5125f53b74f10468ffc0e5de95293f8e04af64ff41154663015098a4ea4a666f4d3f625f120c3ddf7411d6508011e6609dc9944b3ad963a1431d76cc41949be8ee6