e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
Size

66KB
MD5

dd8b65f1d4ecebed5772b7d623b942e4
SHA1

e2511f0bbc57295b3dd3e9374c996090ff4f5d99
SHA256

e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49
SHA512

30feb58f7ec2b780d3943a030ae82f9a534bd2a0b3e3177699b3270d84e6af3d7ed73bc03fbf89364fadc1bbd5946f038b4c9543401db6e23fde0a96aa91d94e
SSDEEP

1536:xjMqxL2Q3qOLjp01Y06JdOGZqlSmQBazb:xAyLd0K/JdOnzb

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\I:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\Y:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\U:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\O:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\M:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\L:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\K:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\Z:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\X:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\T:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\S:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\R:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\W:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\V:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\Q:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\H:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\P:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\N:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\G:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened (read-only)	\??\E:	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpenc.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2312	2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe	30
PID 2276 wrote to memory of 2312	2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe	30
PID 2276 wrote to memory of 2312	2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe	30
PID 2276 wrote to memory of 2312	2276	e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe	30
PID 2312 wrote to memory of 2816	2312	net.exe	32
PID 2312 wrote to memory of 2816	2312	net.exe	32
PID 2312 wrote to memory of 2816	2312	net.exe	32
PID 2312 wrote to memory of 2816	2312	net.exe	32

C:\Users\Admin\AppData\Local\Temp\e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe
"C:\Users\Admin\AppData\Local\Temp\e8a559a7313f1ac18df5c490ffc3d65cc7b668077ec2b8544385d632275c3d49.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
610KB

MD5
b428d62e2f317326998fbc958e194f17

SHA1
40ba3c6f318088a507802a6162d3b420e7b37a39

SHA256
bf3a22b45d18a042da98ba07bd5c4e25487b509e504a8a931b91512c14871399

SHA512
bcdfe82473e92f8b7d6edac1f3ae9d80a16b41adb20e3e246c6d77abbdda63fd958da9a3c762af8a5a1f658f2941cc861bf12fd92dd29a52b6717d316b2c0530

Download Submit
memory/2276-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-143-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2276-219-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download