6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b

General

Target

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
Size

10.0MB
MD5

f08fc668957c17905520d63bae85114a
SHA1

a802235e8e390cb700396f7ee6eda73c27289484
SHA256

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b
SHA512

cedc25745fbd376627c119cfc481627ac574ae3d92f4d888538d88a344b57a66e47ca3f6ae7580ff154a5c11fd2325057cf194784c1e357f0756884d37e1da9e
SSDEEP

98304:He5x6c1NogP2NhS9Yw8ywowUUIGYlFlehRC4tNuTBp8BzB+0LuxttZiSELtebmab:gJawfwVs3TehREvjD8th9VzW

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe"	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Drops file in Program Files directory 64 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
File created	C:\Program Files\Windows Mail\WinMail.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fontconfig.properties.src	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Mail\wab.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Sidebar\sidebar.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

pid	process
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

pid	process
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
2904	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

C:\Users\Admin\AppData\Local\Temp\6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
"C:\Users\Admin\AppData\Local\Temp\6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Uninstall.exe

Filesize
10.0MB

MD5
1681b33bfc4ac7aeac92aa731574f38a

SHA1
73366c193c78a726ff2cae3c898a8b08b1b31b31

SHA256
28e22365ef1163cb5832603428836d5e81db3d589b826b49107a0bfa22d791e0

SHA512
085f96df6670f542a570147fab0883680080d84ccdb2876e3955db0831465ba16664311749e16a685e9dd9df24997c2138fb1842a0e7f9bd30bb845e826d0227

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads