Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 13:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
474154665ebc859234a22c787a1d6580N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
474154665ebc859234a22c787a1d6580N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
474154665ebc859234a22c787a1d6580N.exe
-
Size
9.8MB
-
MD5
474154665ebc859234a22c787a1d6580
-
SHA1
133af4a447f726d77477224ef059ad350dfff69b
-
SHA256
d1ae7e3e149273bd773ea3004f8d003031464141a5dbbaff91ea33986b7b5bf8
-
SHA512
02de4640dfd2e9dd03a3947898a2d1cbd95bcc96d0625d6c656c6cd7589e8d20c83756d977edb5904ef87e7ff92d52f5993d0d5f4cec47f53fde5ab323927561
-
SSDEEP
196608:ikTqnhgJuP3LAhCiVXOWtkA1oMuWr45hrr2l:vES+LJWeJWGhrr2l
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2544 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe 1548 msinfowindows.exe 1104 wkconvmicrosoft.exe 1648 windowssystem.exe -
Loads dropped DLL 16 IoCs
pid Process 2940 474154665ebc859234a22c787a1d6580N.exe 2544 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe 2544 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe 2544 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1548 msinfowindows.exe 1548 msinfowindows.exe 1548 msinfowindows.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1104 wkconvmicrosoft.exe 1104 wkconvmicrosoft.exe 1104 wkconvmicrosoft.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1648 windowssystem.exe 1648 windowssystem.exe 1648 windowssystem.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeLines = "c:\\program files (x86)\\microsoft office\\media\\office14\\lines\\elementslines.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\SendToOneNotePrintDriverUISendToOneNoteFilter14.0.4763.1000 = "c:\\program files (x86)\\microsoft office\\office14\\onenote\\sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\474154665ebc859234a22c787a1d6580N.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\sqloledbmsdasqlr = "c:\\program files (x86)\\common files\\system\\ole db\\en-us\\sqloledbsqloledb.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WindowsSystem = "c:\\program files (x86)\\common files\\system\\ja-jp\\windowssystem.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\474154665ebc859234a22c787a1d6580N.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\msinfomsinfo6.1.7600.16385 = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\de-de\\msinfowindows.exe" 474154665ebc859234a22c787a1d6580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WkconvMicrosoft = "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wksconv\\wkconvmicrosoft.exe" 474154665ebc859234a22c787a1d6580N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll wkconvmicrosoft.exe File created C:\Windows\SysWOW64\ntdll.dll.dll windowssystem.exe File created C:\Windows\SysWOW64\ntdll.dll.dll 474154665ebc859234a22c787a1d6580N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe File created C:\Windows\SysWOW64\ntdll.dll.dll msinfowindows.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\msinfoWindows.exe 474154665ebc859234a22c787a1d6580N.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\ElementsLines.exe 474154665ebc859234a22c787a1d6580N.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNotePrintDriverUISendToOneNotePrintDriverUI.exe 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\RCXC2B5.tmp 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\RCXD878.tmp 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\ElementsLines.exe 474154665ebc859234a22c787a1d6580N.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqloledbsqloledb.exe 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\RCXD848.tmp 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\WkconvMicrosoft.exe 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\RCXD8B8.tmp 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\RCXC1D9.tmp 474154665ebc859234a22c787a1d6580N.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\RCXC266.tmp 474154665ebc859234a22c787a1d6580N.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\WindowsSystem.exe 474154665ebc859234a22c787a1d6580N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\WkconvMicrosoft.exe 474154665ebc859234a22c787a1d6580N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msinfowindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wkconvmicrosoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowssystem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474154665ebc859234a22c787a1d6580N.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 474154665ebc859234a22c787a1d6580N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 windowssystem.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msinfowindows.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wkconvmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString windowssystem.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 474154665ebc859234a22c787a1d6580N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier msinfowindows.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wkconvmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wkconvmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier windowssystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 474154665ebc859234a22c787a1d6580N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msinfowindows.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2544 sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1548 msinfowindows.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1104 wkconvmicrosoft.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 1648 windowssystem.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe 2940 474154665ebc859234a22c787a1d6580N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 2544 2940 474154665ebc859234a22c787a1d6580N.exe 32 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1548 2940 474154665ebc859234a22c787a1d6580N.exe 33 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1104 2940 474154665ebc859234a22c787a1d6580N.exe 34 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35 PID 2940 wrote to memory of 1648 2940 474154665ebc859234a22c787a1d6580N.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\474154665ebc859234a22c787a1d6580N.exe"C:\Users\Admin\AppData\Local\Temp\474154665ebc859234a22c787a1d6580N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\program files (x86)\microsoft office\office14\onenote\sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe"c:\program files (x86)\microsoft office\office14\onenote\sendtoonenoteprintdriveruisendtoonenoteprintdriverui.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
\??\c:\program files (x86)\common files\microsoft shared\msinfo\de-de\msinfowindows.exe"c:\program files (x86)\common files\microsoft shared\msinfo\de-de\msinfowindows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1548
-
-
\??\c:\program files (x86)\common files\microsoft shared\textconv\wksconv\wkconvmicrosoft.exe"c:\program files (x86)\common files\microsoft shared\textconv\wksconv\wkconvmicrosoft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
\??\c:\program files (x86)\common files\system\ja-jp\windowssystem.exe"c:\program files (x86)\common files\system\ja-jp\windowssystem.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
MD5474154665ebc859234a22c787a1d6580
SHA1133af4a447f726d77477224ef059ad350dfff69b
SHA256d1ae7e3e149273bd773ea3004f8d003031464141a5dbbaff91ea33986b7b5bf8
SHA51202de4640dfd2e9dd03a3947898a2d1cbd95bcc96d0625d6c656c6cd7589e8d20c83756d977edb5904ef87e7ff92d52f5993d0d5f4cec47f53fde5ab323927561
-
Filesize
9.8MB
MD56016de13dae963d36c6633f504c200f6
SHA1f898216c9033ae8845332695747e74ddecdf2e55
SHA2565d3e3586e2d0654213cb71c47d0275b0468f17d7661886b34e54070bf0d96535
SHA51269f105eb3b3a694dfc7202c876af6d5b4f381059352a86f6e64cab198ce2cd2fb74c0205a94fdf1d97c238cc71caadd144ba7a11dc1a0e42ca33e8a8986ca1d8