Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe
Resource
win7-20240705-en
General
-
Target
064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe
-
Size
80KB
-
MD5
06857960ed15c74cad9ab671d81b2499
-
SHA1
772725e1f16a2ae739d2a7cf99d5f91a1d2c8af5
-
SHA256
064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e
-
SHA512
31aa0a1a8ce79e4a5fc53ef498d8e7eda0d8339798a2ab3eab19a8a29e2c4429ffca88b43940f609543a069befc06fb270787bd8e0a54bba283eef219b57d071
-
SSDEEP
1536:fHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZHCwGCq2iW7z:fhAWJGSCTBf12ZiwGCH
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000a000000012029-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1716 CfXl.exe -
Loads dropped DLL 2 IoCs
pid Process 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe CfXl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe CfXl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe CfXl.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe CfXl.exe File opened for modification C:\Program Files\Windows Mail\wab.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe CfXl.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE CfXl.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe CfXl.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe CfXl.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe CfXl.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe CfXl.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe CfXl.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE CfXl.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe CfXl.exe File opened for modification C:\Program Files\7-Zip\7zG.exe CfXl.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe CfXl.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE CfXl.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe CfXl.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe CfXl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe CfXl.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe CfXl.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe CfXl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe CfXl.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe CfXl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe CfXl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe CfXl.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe CfXl.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe CfXl.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe CfXl.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe CfXl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe CfXl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE CfXl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CfXl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1716 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe 30 PID 1368 wrote to memory of 1716 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe 30 PID 1368 wrote to memory of 1716 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe 30 PID 1368 wrote to memory of 1716 1368 064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe 30 PID 1716 wrote to memory of 2644 1716 CfXl.exe 32 PID 1716 wrote to memory of 2644 1716 CfXl.exe 32 PID 1716 wrote to memory of 2644 1716 CfXl.exe 32 PID 1716 wrote to memory of 2644 1716 CfXl.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe"C:\Users\Admin\AppData\Local\Temp\064a4bab3bbf33a2f0e8fab431d36b9c799ef46d2d59c82f6d30a70a25956e3e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\CfXl.exeC:\Users\Admin\AppData\Local\Temp\CfXl.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6c862ddc.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2644
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
183B
MD5ac74514b93461e93a8d2e6d8dd40b889
SHA176b93d5cefa7741f864e3998d57ac57c5c67e649
SHA256bb4e38fb0b90a6025e79f95bcdf087eb46d7c27ff06813871eb06c2a3e26be54
SHA51244ea3c150da081febc1882738fa9d6046d9fdfd578fa896717da773b94040162793e58c7f9fa553e81036a6a33c9706d653acd7498c6e0b7b9c5e843c24bd29d
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3