Analysis
- max time kernel
114s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral2
Sample
f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
120 seconds
General
- Target f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe
- Size 597KB
- Sample241111-xt5a4athqh
- SHA256 f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2
- MD5 c39d3ea8e65e6efd1f97e8037cfe3d38
- SHA1 39a15400f92099602ac8b8355023846b2d3b7d0f
- SHA512 6ab512c0f27f8372c0e9add29b8288b263a39286bca6693b28a9697a8ddebfe1d6474cdabd1db7614bc0f3e96300afa86d4eb282c8675efce8ff5949f370b2c5
- SSDEEP 12288:fJHPaZZZtAv5OLpdNIrd4Ds5OLpdNIrd4Dw2r:B8IRmXIrdFmXIrdb2r
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Windows\SysWOW64\fsb.tmp f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe -
resource yara_rule behavioral2/files/0x00030000000229a0-7.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\7-Zip\Uninstall.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Google\Update\Install\{1D4B5551-822C-42C0-B673-53AB80587853}\chrome_installer.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe"C:\Users\Admin\AppData\Local\Temp\f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 7bb6b9df82f4f89f53de4b678fb06ecd5a2e9396a7de5fd943446d1ea44e9f10
- MD5 65ee725c7f67da54064eed28d8a4d1f4
- SHA1 ddad24210c9ba34724cd3c82654229ba4987d2a2
- SHA512 c78266bd3d9baae4dc66f282c9f9c125e5f5026fb92ff199acaeb23cc53641927db7334cef145ca481ea7f5922ec56e8424a0f6e8670cc83244996b8aeaf5779
- SSDEEP 12288:HPQJHPaZZZtAv5OLpdNIrd4Ds5OLpdNIrd4Dw277a3iwbihym2g7XO3LWUQfh4Co:U8IRmXIrdFmXIrdb2a+gkE2fh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\fsb.tmp
- Size 597KB
- SHA256 f49be723f5e8de48aaad5bffd6a9c0278d964ac2248bc810ba23d3b0231b82e2
- MD5 c39d3ea8e65e6efd1f97e8037cfe3d38
- SHA1 39a15400f92099602ac8b8355023846b2d3b7d0f
- SHA512 6ab512c0f27f8372c0e9add29b8288b263a39286bca6693b28a9697a8ddebfe1d6474cdabd1db7614bc0f3e96300afa86d4eb282c8675efce8ff5949f370b2c5
- SSDEEP 12288:fJHPaZZZtAv5OLpdNIrd4Ds5OLpdNIrd4Dw2r:B8IRmXIrdFmXIrdb2r
- MD5 SHA1 SHA512 SSDEEP