Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a16ff17f73edf4b0ff82670f1b4f6a10N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
a16ff17f73edf4b0ff82670f1b4f6a10N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
a16ff17f73edf4b0ff82670f1b4f6a10N.exe
-
Size
9.7MB
-
MD5
a16ff17f73edf4b0ff82670f1b4f6a10
-
SHA1
009538052666905a36c2c12c7caa58e83887afe1
-
SHA256
646c0854f6d90d2c71c3ae9a73d4ea5e40c9d82790e0c5429b448a0afaccee75
-
SHA512
2435e43ba87c78c9e6466afab9516a7b92d87dd22ca1814bd3fd314c31cf80127e70902f27f13f2e56eb3dd6555f09a4017d32ee8806f1f3b6b61589d6be16a0
-
SSDEEP
196608:HGqnhgJuP3LAhCiVXOWvd6A1oMuWr45hrr2j:HS+LJYeJWGhrr2j
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2736 officevisualstudio.exe 2200 wordpadwordpad.exe 1816 logsessionacrotextextractor.exe 1380 nppdf32adobe.exe -
Loads dropped DLL 16 IoCs
pid Process 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2736 officevisualstudio.exe 2736 officevisualstudio.exe 2736 officevisualstudio.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2200 wordpadwordpad.exe 2200 wordpadwordpad.exe 2200 wordpadwordpad.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 1816 logsessionacrotextextractor.exe 1816 logsessionacrotextextractor.exe 1816 logsessionacrotextextractor.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 1380 nppdf32adobe.exe 1380 nppdf32adobe.exe 1380 nppdf32adobe.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16ff17f73edf4b0ff82670f1b4f6a10N.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\NPPDF32Adobe = "c:\\program files (x86)\\adobe\\reader 9.0\\reader\\browser\\nppdf32adobe.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOperating = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\ja-jp\\windowsoperating.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\VisualStudioVisualStudio = "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\pipeline.v10.0\\addinviews\\officevisualstudio.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Microsoftwordpad = "c:\\program files (x86)\\windows nt\\accessories\\ja-jp\\wordpadwordpad.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icudt36icuuc36 = "c:\\program files (x86)\\adobe\\reader 9.0\\reader\\logsessionacrotextextractor.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16ff17f73edf4b0ff82670f1b4f6a10N.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" a16ff17f73edf4b0ff82670f1b4f6a10N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SmallSetup = "c:\\program files (x86)\\adobe\\reader 9.0\\setup files\\{ac76ba86-7ad7-1033-7b44-a90000000001}\\smallbootstrapper.exe" a16ff17f73edf4b0ff82670f1b4f6a10N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll officevisualstudio.exe File created C:\Windows\SysWOW64\ntdll.dll.dll wordpadwordpad.exe File created C:\Windows\SysWOW64\ntdll.dll.dll logsessionacrotextextractor.exe File created C:\Windows\SysWOW64\ntdll.dll.dll nppdf32adobe.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\OfficeVisualStudio.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\RCX4E8F.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\WindowsOperating.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\SmallBootstrapper.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\SmallBootstrapper.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\RCX4E31.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\NPPDF32Adobe.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\RCX6452.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogSessionAcroTextExtractor.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogSessionAcroTextExtractor.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX655D.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WORDPADwordpad.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\ja-JP\RCX4DF1.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WORDPADwordpad.exe a16ff17f73edf4b0ff82670f1b4f6a10N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\RCX6491.tmp a16ff17f73edf4b0ff82670f1b4f6a10N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a16ff17f73edf4b0ff82670f1b4f6a10N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language officevisualstudio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wordpadwordpad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language logsessionacrotextextractor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nppdf32adobe.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a16ff17f73edf4b0ff82670f1b4f6a10N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString officevisualstudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier officevisualstudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wordpadwordpad.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 logsessionacrotextextractor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier nppdf32adobe.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a16ff17f73edf4b0ff82670f1b4f6a10N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a16ff17f73edf4b0ff82670f1b4f6a10N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier logsessionacrotextextractor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString nppdf32adobe.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wordpadwordpad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString logsessionacrotextextractor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 officevisualstudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wordpadwordpad.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 nppdf32adobe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2736 officevisualstudio.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2200 wordpadwordpad.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 1816 logsessionacrotextextractor.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 1380 nppdf32adobe.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2736 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 31 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 2200 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 32 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1816 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 33 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34 PID 2644 wrote to memory of 1380 2644 a16ff17f73edf4b0ff82670f1b4f6a10N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16ff17f73edf4b0ff82670f1b4f6a10N.exe"C:\Users\Admin\AppData\Local\Temp\a16ff17f73edf4b0ff82670f1b4f6a10N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\addinviews\officevisualstudio.exe"c:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\addinviews\officevisualstudio.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
\??\c:\program files (x86)\windows nt\accessories\ja-jp\wordpadwordpad.exe"c:\program files (x86)\windows nt\accessories\ja-jp\wordpadwordpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
\??\c:\program files (x86)\adobe\reader 9.0\reader\logsessionacrotextextractor.exe"c:\program files (x86)\adobe\reader 9.0\reader\logsessionacrotextextractor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
\??\c:\program files (x86)\adobe\reader 9.0\reader\browser\nppdf32adobe.exe"c:\program files (x86)\adobe\reader 9.0\reader\browser\nppdf32adobe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD5e1348e17298becd6cf87a2832167d6a1
SHA1d408f35b8761f5e8462989583e09475b5544949f
SHA2564e2b020dab290ac9f3968c41311a93769507bab5bd1525627dd61c0e64cce6ff
SHA512fc27c8ed23bb02fc3ded7d28a72c444a538e3eb42c0e3cd39e14ba088baa1a3a625eb56a6e56a3158d5746c4a4d8fbd51f6fa345967d6ac9610ce0af2b587a6d
-
Filesize
9.7MB
MD5a16ff17f73edf4b0ff82670f1b4f6a10
SHA1009538052666905a36c2c12c7caa58e83887afe1
SHA256646c0854f6d90d2c71c3ae9a73d4ea5e40c9d82790e0c5429b448a0afaccee75
SHA5122435e43ba87c78c9e6466afab9516a7b92d87dd22ca1814bd3fd314c31cf80127e70902f27f13f2e56eb3dd6555f09a4017d32ee8806f1f3b6b61589d6be16a0