Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe
-
Size
928KB
-
MD5
84837299bbcd8ce45b606a1f9d33f798
-
SHA1
65b7024c060432e5eadefe4ee0ed328a93561d03
-
SHA256
746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef
-
SHA512
27404b8bcf614bc219b529eb2cf65a50bd829af675db933752687fdb0b1cc75f848ae4f9be60416cd5073f532a4dc5fbf01b386e245d36efa2d87e70606e1289
-
SSDEEP
24576:V1bSl988U7BwSGh3+PH6HQfDMs6myLuQtgbf1AGa:V8fyGhOSwfDMsILuf1Pa
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\sIRC4.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe"C:\Users\Admin\AppData\Local\Temp\746a519f3c5f3bbaac67a763b7a917b9d7af8094a321a852b5cbfbd5ad09eaef.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
930KB
MD59aed825a33498358e426ab5d5c73f866
SHA11d28be3c40fa0a85ad8b642e21b953b5158e174a
SHA2566da53eb23eb34fe347f29840c6ecd5bd66d268923644273fad2ba9adf864a842
SHA512ecd8fb28a49bc413c926391b061dd3aed4b47303f46285fbd62147b50ccfac776b1ca72f64a990ccd5b496e68511a4edaf30d3abb1402e95a3a55641c59284e1