Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
241fc92010656375a2457ba4428b31e0N.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
241fc92010656375a2457ba4428b31e0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
241fc92010656375a2457ba4428b31e0N.exe
-
Size
91KB
-
MD5
241fc92010656375a2457ba4428b31e0
-
SHA1
ef39db03d0880f5860e5cb33071eeda755018405
-
SHA256
391f2de6b0d739e93649703e08bd8aa5489eacff99789c903633fa24a97c746b
-
SHA512
9701eef800338ee2edc68109069ae0fe8ba554860e1375ec697a997dee320c8d1539f45e4eae44a7ddd852eb05d2c9fdcd9f291dbd53bc58f25c8b4223da3538
-
SSDEEP
1536:4aiqH1s+kCtrA2UMT0mTFibDKa1Xk+SezSOY6Ukg2dTtzy:51B31bdBob2QXbSezI6UPl
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 241fc92010656375a2457ba4428b31e0N.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8806.tmp 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8847.tmp 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8846.tmp 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX88A5.tmp 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 241fc92010656375a2457ba4428b31e0N.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 241fc92010656375a2457ba4428b31e0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 241fc92010656375a2457ba4428b31e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD581a8943010163b01044cd080852509ee
SHA15c86a89e21de46883ec95cf266a5943f46da9aab
SHA2561cbd219f1b0924145abaae58f2e8e251c1fc360afc1c9021ba79aae39045818d
SHA512ed855448462bd821af549b86882535673487d38838ab65b3297ad0f4a7bf9106d18eb0e0a1f2d1943fb7eaba3dfa670ab58afe1c14af6bfaa6cbb4b9f4ff1356
-
Filesize
930KB
MD519663798edf55457479556ef28de919c
SHA176fa0db1032368c7b813128645e9e664bee2fd5d
SHA25650fcd3fc03f3174999fea9364b8b40d59042ea11cff74fea1a9614d02016b1aa
SHA512775c2ddf52b5fa7016c803f0b10f7bd6ad85ffe98b5ea5ddcf2279d5dc3eb91abcd63a4ed2763e2894d4d7d301f41779bf70b74eca280c4739bdd325587bd6b5