be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
Size

6.0MB
MD5

6d47997c7b35a68b7b71057be8d554e2
SHA1

582c56c4b300bb4cfacf93894a0d8cc0e55db221
SHA256

be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99
SHA512

7ea11617569d9e1c73b3d228d6f1e96e3360e9231672f161acd8710db59c9209840a3a8888399bf60db507e6b2619b29e075c185865f18ce470fa4a0afc1c0be
SSDEEP

49152:w8YBR/kLYjAFjYtalkMyXh/ZMlqFxp73ooGBHI+ruP3A5GhOoT8NXadkMG1hdAKW:xIJpMqnhIHVruP3Ld81hCHC/zZWN

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe"	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe"	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntdll.dll.dll	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt60AcroCEF.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCXA2A2.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RCX26CF.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\Checkerjaureg.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\RCX4537.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\textsqlite.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCX9178.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BSAFECoolType.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\ieinstalieinstal.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX1FC8.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msaddsrWindows.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\Googlegoopdateresvi.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMManager.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX7A44.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\RCX3CC9.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\AcrobatNPPDF32.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\RCX89E6.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX5005.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AdobeAcrobat.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AdobeMake.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAcrobat.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\ja-JP\RCX23D0.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Studiosystem.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\Checkerjaureg.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\RCX3E50.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMManager.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAdobe.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\ieinstalieinstal.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffiltOperating.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\textsqlite.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA12A.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCXACA6.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\Googlegoopdateresvi.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX886E.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\RCX69E7.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BSAFECoolType.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9D12.tmp	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt60AcroCEF.exe	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
4868	be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe

C:\Users\Admin\AppData\Local\Temp\be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe
"C:\Users\Admin\AppData\Local\Temp\be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCXA2A2.tmp

Filesize
6.0MB

MD5
a98515b6192b81d3e2f6320b8f961b69

SHA1
adae61adb2dd0f3242326cf4e637860c087095f0

SHA256
24e32761fc23209770faa78b5cf6a0d1c59848344948ee31a272cf44c05d51e1

SHA512
7a1950deddb145d98cce7a81b6f887b2cbf540c833187d0e4c1ea013fa6912f8b5f0f1614eaa36ccba3026b8acb83bdb9ee1d379f8d8de927c93e15970c1c851

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt60AcroCEF.exe

Filesize
11.9MB

MD5
890d9e172677275505c3b2483723daaf

SHA1
a43884d534309c726cff1d9e0aa618a7edf3840b

SHA256
733d80355d40aa5f804caa10adf7bbb47d18cecb03dfbf50efe1a184e2c8bfcb

SHA512
26aee87e35484121303fae9b9f1ecde1c1a6dfb88d822a9d251f03f0506e9b08bfd0394dba74e85166d3611d5424605557c5ec4be012e77f407756cbf6f5e8d0

Download Submit
C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msaddsrWindows.exe

Filesize
6.0MB

MD5
09553c1ea9e6df2b369e8cba02fca3f2

SHA1
1ea64d07acc0b248e6298406a6c7aa2642990b8d

SHA256
267b90b1b08d028ec856e03b5075c9d9b6e51eed3b93efa783a1a6374485db61

SHA512
17b75f83dab0c6798589e350b299c1323bb9225a54465fefeef6e4cb602da84e4efd2d451586012e959a8f53a0caae1c6209a1fb820f1b097dc8a1637a2c7737

Download Submit
C:\Program Files (x86)\Internet Explorer\it-IT\ieinstalieinstal.exe

Filesize
6.0MB

MD5
6d47997c7b35a68b7b71057be8d554e2

SHA1
582c56c4b300bb4cfacf93894a0d8cc0e55db221

SHA256
be8e8d8063da116e9838a5493b80c0f1bfd188e8d41934c426672becc6079a99

SHA512
7ea11617569d9e1c73b3d228d6f1e96e3360e9231672f161acd8710db59c9209840a3a8888399bf60db507e6b2619b29e075c185865f18ce470fa4a0afc1c0be

Download Submit