4a614cec822a3e23aaf0595f1e95fe8d52f3ada9f826d32639a2ef9987e85117

Analysis

max time kernel
112s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fa24a245bf38138f047b4a673114aca.exe
Size 3.6MB
Sample240613-cb9smsterp
SHA256 4a614cec822a3e23aaf0595f1e95fe8d52f3ada9f826d32639a2ef9987e85117
MD5 9fa24a245bf38138f047b4a673114aca
SHA1 7581e1d4835b1c3498cfdfdcf25fc72e862171ce
SHA512 ec5e2750dfdc4ca6d691616517c8b82b44c5a1d874b096923f21c0fe0add5cc71bcb356f8c838a4bf49f3ffbadce73302a167376f4da81b03aad3b193282bf06
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMc:HmRIDQciiwIDQc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4884	60.#.exe
4032	907.#.exe
4476	761.#.exe
1780	961.#.exe
1648	493.#.exe
5540	751.#.exe
4084	301.#.exe
2428	803.#.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	761.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	301.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	803.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	907.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	60.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	961.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	493.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	751.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	9fa24a245bf38138f047b4a673114aca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\	907.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\	761.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\	961.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\	961.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\	907.#.exe
File opened for modification	C:\Program Files\dotnet\shared\	751.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\	60.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\	961.#.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\	907.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\	907.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\	961.#.exe
File opened for modification	C:\Program Files\Google\Chrome\	751.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\	493.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\	761.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	907.#.exe
File opened for modification	C:\Program Files\dotnet\	493.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\	907.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\	751.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	761.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\	961.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\	761.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	493.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\	493.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\	60.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\	493.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\	493.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\	60.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\	60.#.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	60.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\	493.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\	907.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\	761.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\	961.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\	961.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\	493.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\	961.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Google\	961.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\	907.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\	961.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\	60.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	907.#.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\	907.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\	761.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Program Files\dotnet\shared\	761.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\	961.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\	751.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\	60.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	9fa24a245bf38138f047b4a673114aca.exe

NTFS ADS 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	907.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	803.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	493.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	751.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	301.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	9fa24a245bf38138f047b4a673114aca.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	60.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	761.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	961.#.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
840	9fa24a245bf38138f047b4a673114aca.exe
4884	60.#.exe
4032	907.#.exe
4476	761.#.exe
1780	961.#.exe
1648	493.#.exe
5540	751.#.exe
4084	301.#.exe
2428	803.#.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 4884	840	9fa24a245bf38138f047b4a673114aca.exe	85
PID 840 wrote to memory of 4884	840	9fa24a245bf38138f047b4a673114aca.exe	85
PID 840 wrote to memory of 4884	840	9fa24a245bf38138f047b4a673114aca.exe	85
PID 4884 wrote to memory of 4032	4884	60.#.exe	86
PID 4884 wrote to memory of 4032	4884	60.#.exe	86
PID 4884 wrote to memory of 4032	4884	60.#.exe	86
PID 4032 wrote to memory of 4476	4032	907.#.exe	87
PID 4032 wrote to memory of 4476	4032	907.#.exe	87
PID 4032 wrote to memory of 4476	4032	907.#.exe	87
PID 4476 wrote to memory of 1780	4476	761.#.exe	89
PID 4476 wrote to memory of 1780	4476	761.#.exe	89
PID 4476 wrote to memory of 1780	4476	761.#.exe	89
PID 1780 wrote to memory of 1648	1780	961.#.exe	91
PID 1780 wrote to memory of 1648	1780	961.#.exe	91
PID 1780 wrote to memory of 1648	1780	961.#.exe	91
PID 1648 wrote to memory of 5540	1648	493.#.exe	92
PID 1648 wrote to memory of 5540	1648	493.#.exe	92
PID 1648 wrote to memory of 5540	1648	493.#.exe	92
PID 5540 wrote to memory of 4084	5540	751.#.exe	93
PID 5540 wrote to memory of 4084	5540	751.#.exe	93
PID 5540 wrote to memory of 4084	5540	751.#.exe	93
PID 4084 wrote to memory of 2428	4084	301.#.exe	94
PID 4084 wrote to memory of 2428	4084	301.#.exe	94
PID 4084 wrote to memory of 2428	4084	301.#.exe	94

C:\Users\Admin\AppData\Local\Temp\9fa24a245bf38138f047b4a673114aca.exe
"C:\Users\Admin\AppData\Local\Temp\9fa24a245bf38138f047b4a673114aca.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\60.#.exe
  C:\Users\Admin\AppData\Local\Temp\60.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\907.#.exe
    C:\Users\Admin\AppData\Local\Temp\907.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\761.#.exe
      C:\Users\Admin\AppData\Local\Temp\761.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\961.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\961.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\493.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\493.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\751.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\751.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\301.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\301.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\803.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\803.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\879.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\879.#.exe
        10⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\717.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\717.#.exe
        11⤵
        
        PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jstatd.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$
Size 3.7MB
SHA256 dc66a786d9a72ed1587a6bee29d434196d65c00481a5e94a9853c7f207b556ce
MD5 e00d3f6042c1f9fd557f223b8567c757
SHA1 0ef34b345f89f66564c62fdbcac71a3a0d3e1267
SHA512 6e4ec40c6f57667d902f2c4309eb5ea888fb5d2c8451c37285a1e5af8f711a8288cfb4af3d7ae2209467bf0f06092190391ff1eb1614c9926ed815289e976c89
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMc7:HmRIDQciiwIDQc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

klist.exe$

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
Size 3.7MB
SHA256 d53d2fb42d423c91875a6a6e1d18c3115149eb7f59a55a7da88c52fe94e4630b
MD5 28fca6211a545554e2d3434fcc6b4045
SHA1 7a2a593900aac348883d02dc7b75305eade05878
SHA512 e25bfdcd8a2e9ba81648289da58455efd8b5fbc2c4349485a203dbb94a001e85096e3034433c2b554d66aab9a7195465c16c29dfc476271b4ec43298504a30c3
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMcC:HmRIDQciiwIDQcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktab.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
Size 3.7MB
SHA256 513ea49740be3f4172b8439545bc0a0d3cbd450e8476e674ac16a63642413678
MD5 00c28898c2050a94433db76f867d95bc
SHA1 81ddc7690da7fba7f362df73e9bacc47ff4512df
SHA512 adb6e84fdd0e4e6db6be68f9d5c84b21fb10e81d601db729db3268f6801e51709f1f2a239e72bc810d3e9744506690f07fdc5c38950eadc88735a663ede469a8
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMcp:HmRIDQciiwIDQcp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktab.exe$

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
Size 3.7MB
SHA256 576912618967d4754388ce754194785dcfcf546b149383797e36d1384b79a883
MD5 3ba4fa0f69e7bae204e56acd985859f5
SHA1 d4321b5152e1ed9961ef79ad52efd926fee95325
SHA512 3a0a4239b7118d12356c7442dc47e3997abfe64ff25c2049ac1d98124b42079a30e033e2ccd0e2e1e8791fdea6f8d1c7a8a20a624f04c6988170fa58d0451d54
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMc/:HmRIDQciiwIDQc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 3.7MB
SHA256 5b3ae0252fb6e23a19a9cf93db5c5a1721d05ff18902813df2b9d7c4573273bc
MD5 a56b1c7f44d87b2d68cd11389c21a16e
SHA1 96a67b3006e2283bd1ca3aaa567848f296376195
SHA512 c6b2dcd4e5078573d84118eddf8b31c279722d033d2dd73ea049613d75602bf5ab370b58e33121cbc0cb19197a792588c59d36feba2cd50a11be2f46060e1fd4
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMc0:HmRIDQciiwIDQc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

60.#.exe

Path C:\Users\Admin\AppData\Local\Temp\60.#.exe
Size 3.6MB
SHA256 4a614cec822a3e23aaf0595f1e95fe8d52f3ada9f826d32639a2ef9987e85117
MD5 9fa24a245bf38138f047b4a673114aca
SHA1 7581e1d4835b1c3498cfdfdcf25fc72e862171ce
SHA512 ec5e2750dfdc4ca6d691616517c8b82b44c5a1d874b096923f21c0fe0add5cc71bcb356f8c838a4bf49f3ffbadce73302a167376f4da81b03aad3b193282bf06
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciin/4MnYYJ2ZhqSGLHkJEMc:HmRIDQciiwIDQc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads