Analysis
-
max time kernel
77s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 11:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
General
-
Target
e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe
-
Size
92KB
-
MD5
eec42b578faddb293347cd5e8d82a690
-
SHA1
421731058119966a85e1deecae64608dfb255b40
-
SHA256
e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778
-
SHA512
f2743e7a39400d71cbae47865add45d4860e851456236378fe37d882706c1aec826c7dfd4fe183e6d43f1606069cd443885e163f691c7a025d995e8491408e02
-
SSDEEP
1536:/JvJnBpwdaMIOOnToIfiV6pdQcTUgaJoeko:/JvxKaCqTBfiooXgkoek
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APPLETVIEWER.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\EULA.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\TEMPLATE.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\CHRMSTP.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KTAB.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SERVERTOOL.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INKWATSON.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBEUPDATERINSTALLMGR.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\CLVIEW.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER64.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTEM.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GROOVEMN.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\CONVERTINKSTORE.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JABSWITCH.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\FLTLDR.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\FLICKLEARNINGWIZARD.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JMAP.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSGEN.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR UPDATER.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBE_UPDATER.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KINIT.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\UNPACK200.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\UNPACK200.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\RMIREGISTRY.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\TABTIP.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SCANPST.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WINMAIL.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SCHEMAGEN.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KTAB.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DW20.EXE e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe"C:\Users\Admin\AppData\Local\Temp\e2005a6896af008b5c7ad9e2bf6fd5f93bd2a7c1abe23286bc3dd8c7e25fe778N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:320