Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 10:03
Behavioral task
behavioral1
Sample
a0f648d9e694e58391ffe778f16529d0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
a0f648d9e694e58391ffe778f16529d0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
120 seconds
General
-
Target
a0f648d9e694e58391ffe778f16529d0N.exe
-
Size
259KB
-
MD5
a0f648d9e694e58391ffe778f16529d0
-
SHA1
ef841a1ca3db7608ed041650ab97470a5abb0b77
-
SHA256
187a3166a30025e565136799632ef7661513ea257c4dbaa9251aaec973d64d65
-
SHA512
a57ea530c9c3551581903251b36d7064e810040bffd038220178e75af01223f15accb1b04250474004f08113de9b42ceecafd4bbe5b09d7e642b74db26dbe541
-
SSDEEP
1536:C5JeZFIF5l3I3CbUqdIxCj8ce9PZ+idI1Ax+i2hTltdJJRaCAd1uhNRs8bzu5VAV:C5wTIFT3uCl8ZBbdI6+PltdxcwiAV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x00070000000234bc-8.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2672 a0f648d9e694e58391ffe778f16529d0N.exe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\7-zip\7zg.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\ink\inputpersonalization.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\mip.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\7-zip\7zfm.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\chrome_pwa_launcher.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\installer\setup.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\7-zip\7z.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.2\createdump.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\google\chrome\application\123.0.6312.106\installer\chrmstp.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\7-zip\7zg.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\7-zip\7z.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\ink\shapecollector.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.2\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\chrome_pwa_launcher.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\msinfo\msinfo32.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\dotnet\dotnet.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\7-zip\7zg.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\office16\liclua.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\elevation_service.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\installer\chrmstp.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\installer\setup.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\shapecollector.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\tabtip.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\office16\liclua.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\google\chrome\application\123.0.6312.106\chrome_pwa_launcher.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\7-zip\uninstall.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\ink\tabtip.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\elevation_service.exe a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\7-zip\7zfm.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\msinfo\msinfo32.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\source engine\ose.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\7-zip\7zfm.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\source engine\ose.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File opened for modification \??\c:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.2\createdump.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\notification_helper.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\7-zip\7z.exe a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe.txt a0f648d9e694e58391ffe778f16529d0N.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2672 1668 a0f648d9e694e58391ffe778f16529d0N.exe 84 PID 1668 wrote to memory of 2672 1668 a0f648d9e694e58391ffe778f16529d0N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f648d9e694e58391ffe778f16529d0N.exe"C:\Users\Admin\AppData\Local\Temp\a0f648d9e694e58391ffe778f16529d0N.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\a0f648d9e694e58391ffe778f16529d0N.exe.exeC:\Users\Admin\AppData\Local\Temp\a0f648d9e694e58391ffe778f16529d0N.exe.exe2⤵
- Executes dropped EXE
PID:2672
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD55d88ebcc4a25f6f7175190b189f95539
SHA149bfdde38663ec123a34de8abc78b0f95c9996e8
SHA2565a2b44873feba45bc86c885e6c32d35951bbae3196757ad13b760d54b3e9b50e
SHA512843c649b963dfe150f8a9aa1783af8b2d5c1a7be71743b54f3ecf9890612e8a2dc54d70f54375cad6773cd39056f852f9dc96fc541e0d831f2d84699168b1362
-
Filesize
228KB
MD588467494a92edf87f196d4889f5dbcc3
SHA1f4f78e34e69eb87375381614c151f3f911c94401
SHA256555991ad172e7e6d3977326f7f4ee88a9374849a8254fe5a2ede136b683c1f51
SHA5121459379fddd38ac3253b731186c5fe6f3a6026543fecce727551dcc1e8f331d3ca24649379f876ba3ca733c52cee2d96d9dd9e72aebae26040735e926dad7e12