Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe
Resource
win10v2004-20241007-en
General
-
Target
1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe
-
Size
78KB
-
MD5
daa0498fa402a7c8564847ac48be78df
-
SHA1
d7fd3531dc44705aa406ed8b437a8c4759e4bef9
-
SHA256
1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca
-
SHA512
83711de1fbd8f5976138651950be591e14a1529d6e2839f748a992ec823e533daa2550fe2a7b36de2c994483d801311ebd4c2b392f60b891ed532337dc4a980c
-
SSDEEP
1536:Z3xz2PuWyliXoauLbtNh6rsIIlezK+QNcUqqqq7m:NWroauLbtNh6rsIKgQemm
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\de-DE\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Microsoft Games\More Games\fr-FR\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File created C:\Program Files\Windows Mail\wab.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Microsoft Office\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Icons\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\it-IT\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe$ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\ 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31 PID 2080 wrote to memory of 1940 2080 1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe"C:\Users\Admin\AppData\Local\Temp\1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s scrrun.dll2⤵
- System Location Discovery: System Language Discovery
PID:1940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca.Axv
Filesize78KB
MD5daa0498fa402a7c8564847ac48be78df
SHA1d7fd3531dc44705aa406ed8b437a8c4759e4bef9
SHA2561bc5c2dede3d2e44c7ce5c8fe622b9da376485d0e4c194f2b72d8781bb569bca
SHA51283711de1fbd8f5976138651950be591e14a1529d6e2839f748a992ec823e533daa2550fe2a7b36de2c994483d801311ebd4c2b392f60b891ed532337dc4a980c