c1d2ba49f593f8c5bbd745731e742326a79e38e39d61d6735cd48208e27f3666

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

118491d812e3f5e6d9db8a5a9869d4f0.exe
Size

76KB
MD5

118491d812e3f5e6d9db8a5a9869d4f0
SHA1

57a2237d27e87eb479508376e0b236ca2363343b
SHA256

c1d2ba49f593f8c5bbd745731e742326a79e38e39d61d6735cd48208e27f3666
SHA512

d3d0b523c12ff931fa41a7b770ae32cdc67f6b548670ec54b48239248185f97ad8675451d62bf308d65e90c4bec75767e2c1aef3d34415c58a77a57e7cf3b81e
SSDEEP

1536:caqR4OA3LAx9u5BWmiwYRSMhXhpBZHqZ0HqZo:cmLAx9u5cmiwYRSMhXhpBZHqZ0HqZo

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-2952504676-3105837840-1406404655-1000\desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-2952504676-3105837840-1406404655-1000\desktop.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Pipeline.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msader15.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\oledb32r.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msxactps.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Internet Explorer\sqmapi.dll	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar	118491d812e3f5e6d9db8a5a9869d4f0.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	118491d812e3f5e6d9db8a5a9869d4f0.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	118491d812e3f5e6d9db8a5a9869d4f0.exe

C:\Users\Admin\AppData\Local\Temp\118491d812e3f5e6d9db8a5a9869d4f0.exe
"C:\Users\Admin\AppData\Local\Temp\118491d812e3f5e6d9db8a5a9869d4f0.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.6MB

MD5
e458da0e322303dc28d9c12ab6418c09

SHA1
30b61bc4b7bb03132a894a23c949f47ddef9c25b

SHA256
b7037744bb522079332dbf11ea5985a5d286aba2f36a5d0bd5ec6f248f5759aa

SHA512
8cc865ba75450df497eb1315d84193e58c794732684851eaa86634933d1ad79de6c1816fd9c3870fab7772ee326ced81513b066cd1f3a77f851316ba45356152

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2196-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2196-52-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2196-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2196-242-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2196-1494-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2196-2141-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads