Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
152b8e1dd2051e56320b4ed579431c80N.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
152b8e1dd2051e56320b4ed579431c80N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
152b8e1dd2051e56320b4ed579431c80N.exe
-
Size
842KB
-
MD5
152b8e1dd2051e56320b4ed579431c80
-
SHA1
e78cca156d4ecbed1595a7894b50f14c5e7217a2
-
SHA256
af7b758f0e5c287a1bde21af1f77cf3d88f9a020093014c887cad63bd050e6d6
-
SHA512
5e06981e5caa318a3d839a029a5548ca583b46e46b72d4b783ba5196b6b41ba9006d178c40da4e3e0de7c1696aa6d0552d84288052727d408aabb19b95087b39
-
SSDEEP
6144:HwynAtMrOVRkidy9yIGWlUiA2uIJ4O8b8ITDnlznZLZAKzD:HwKfOVRo9yRY/F4O8b8ITDnlLJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 596 sistemaoperativo6.1.7600.16385.exe 1856 operatingoeimport.exe 2264 supportcustomer.exe 2676 sistemasistema.exe -
Loads dropped DLL 4 IoCs
pid Process 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MSOERESOperating = "c:\\program files (x86)\\windows mail\\operatingoeimport.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\152b8e1dd2051e56320b4ed579431c80N.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\152b8e1dd2051e56320b4ed579431c80N.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\operativoSistema = "c:\\program files (x86)\\windows photo viewer\\it-it\\sistemasistema.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\pluginplugin = "c:\\program files (x86)\\adobe\\reader 9.0\\reader\\plug_ins3d\\prcrtesselate.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DataMicrosoft1.0.1208.0 = "c:\\program files (x86)\\microsoft synchronization services\\ado.net\\v1.0\\compactsynchronization1.0.1208.0.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Microsoftoperativo6.1.7600.16385 = "c:\\program files (x86)\\windows nt\\accessories\\it-it\\sistemaoperativo6.1.7600.16385.exe" 152b8e1dd2051e56320b4ed579431c80N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\CustomerSupport17818 = "c:\\program files (x86)\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\supportcustomer.exe" 152b8e1dd2051e56320b4ed579431c80N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll sistemasistema.exe File created C:\Windows\SysWOW64\ntdll.dll.dll 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll sistemaoperativo6.1.7600.16385.exe File created C:\Windows\SysWOW64\ntdll.dll.dll operatingoeimport.exe File created C:\Windows\SysWOW64\ntdll.dll.dll supportcustomer.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\RCXD0BB.tmp 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\CompactSynchronization1.0.1208.0.exe 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\SistemaSistema.exe 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\it-IT\RCXBAF6.tmp 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCXBB46.tmp 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Windows Mail\OperatingOEIMPORT.exe 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXD09B.tmp 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Windows NT\Accessories\it-IT\Sistemaoperativo6.1.7600.16385.exe 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\it-IT\Sistemaoperativo6.1.7600.16385.exe 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXBB06.tmp 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Windows Mail\OperatingOEIMPORT.exe 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\SupportCustomer.exe 152b8e1dd2051e56320b4ed579431c80N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcrtesselate.exe 152b8e1dd2051e56320b4ed579431c80N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\RCXD0CC.tmp 152b8e1dd2051e56320b4ed579431c80N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language operatingoeimport.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language supportcustomer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sistemasistema.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 152b8e1dd2051e56320b4ed579431c80N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sistemaoperativo6.1.7600.16385.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sistemaoperativo6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 operatingoeimport.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sistemasistema.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 152b8e1dd2051e56320b4ed579431c80N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sistemaoperativo6.1.7600.16385.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString operatingoeimport.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString supportcustomer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 152b8e1dd2051e56320b4ed579431c80N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sistemaoperativo6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 supportcustomer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sistemasistema.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 152b8e1dd2051e56320b4ed579431c80N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier operatingoeimport.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier supportcustomer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sistemasistema.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 596 sistemaoperativo6.1.7600.16385.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 1856 operatingoeimport.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2264 supportcustomer.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2676 sistemasistema.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe 2556 152b8e1dd2051e56320b4ed579431c80N.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2556 wrote to memory of 596 2556 152b8e1dd2051e56320b4ed579431c80N.exe 33 PID 2556 wrote to memory of 596 2556 152b8e1dd2051e56320b4ed579431c80N.exe 33 PID 2556 wrote to memory of 596 2556 152b8e1dd2051e56320b4ed579431c80N.exe 33 PID 2556 wrote to memory of 596 2556 152b8e1dd2051e56320b4ed579431c80N.exe 33 PID 2556 wrote to memory of 1856 2556 152b8e1dd2051e56320b4ed579431c80N.exe 34 PID 2556 wrote to memory of 1856 2556 152b8e1dd2051e56320b4ed579431c80N.exe 34 PID 2556 wrote to memory of 1856 2556 152b8e1dd2051e56320b4ed579431c80N.exe 34 PID 2556 wrote to memory of 1856 2556 152b8e1dd2051e56320b4ed579431c80N.exe 34 PID 2556 wrote to memory of 2264 2556 152b8e1dd2051e56320b4ed579431c80N.exe 36 PID 2556 wrote to memory of 2264 2556 152b8e1dd2051e56320b4ed579431c80N.exe 36 PID 2556 wrote to memory of 2264 2556 152b8e1dd2051e56320b4ed579431c80N.exe 36 PID 2556 wrote to memory of 2264 2556 152b8e1dd2051e56320b4ed579431c80N.exe 36 PID 2556 wrote to memory of 2676 2556 152b8e1dd2051e56320b4ed579431c80N.exe 37 PID 2556 wrote to memory of 2676 2556 152b8e1dd2051e56320b4ed579431c80N.exe 37 PID 2556 wrote to memory of 2676 2556 152b8e1dd2051e56320b4ed579431c80N.exe 37 PID 2556 wrote to memory of 2676 2556 152b8e1dd2051e56320b4ed579431c80N.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\152b8e1dd2051e56320b4ed579431c80N.exe"C:\Users\Admin\AppData\Local\Temp\152b8e1dd2051e56320b4ed579431c80N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\program files (x86)\windows nt\accessories\it-it\sistemaoperativo6.1.7600.16385.exe"c:\program files (x86)\windows nt\accessories\it-it\sistemaoperativo6.1.7600.16385.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:596
-
-
\??\c:\program files (x86)\windows mail\operatingoeimport.exe"c:\program files (x86)\windows mail\operatingoeimport.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
\??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\supportcustomer.exe"c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\supportcustomer.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
\??\c:\program files (x86)\windows photo viewer\it-it\sistemasistema.exe"c:\program files (x86)\windows photo viewer\it-it\sistemasistema.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
842KB
MD5152b8e1dd2051e56320b4ed579431c80
SHA1e78cca156d4ecbed1595a7894b50f14c5e7217a2
SHA256af7b758f0e5c287a1bde21af1f77cf3d88f9a020093014c887cad63bd050e6d6
SHA5125e06981e5caa318a3d839a029a5548ca583b46e46b72d4b783ba5196b6b41ba9006d178c40da4e3e0de7c1696aa6d0552d84288052727d408aabb19b95087b39
-
Filesize
844KB
MD57461cb9ad5f8382f2de82676d3749c19
SHA1cedfd3f0b0cb1c17c41e1ae544201f6467a04afb
SHA256f3cc676b8cd8f5ccf879b00f17cd3b8be304c449c941c4c7b4153e96c736c20e
SHA512e257c5a5432b86053137593ce327c2b7abecd7896bc350e338cb781c1b991cd37877b6375704d04f998aef86722ff3552e9c434bfa78fc0a4373e69d4ccb750c