d71a46293425f713ccfb98f276d984890186eb43ac0b610b4821fb6f46b8a7e5

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c153e257e19eafb9010e3808b8b9180.exe
Size

2.9MB
MD5

8c153e257e19eafb9010e3808b8b9180
SHA1

caef0f5fc67ebee2a3cf95158dfb5aafdfd0da5b
SHA256

d71a46293425f713ccfb98f276d984890186eb43ac0b610b4821fb6f46b8a7e5
SHA512

7c8f772cfd3622a4e0304bcaf111f8ce927f8e1c1698b57e91334f94e460ea20142772f04ff9d9117792426b889bd740e3e30aea950630ddc41c49954901c6cb
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91xl:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2320-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228a0-5.dat	upx
behavioral2/memory/2320-4555-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/2320-8685-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\desktop.ini	8c153e257e19eafb9010e3808b8b9180.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.jpg.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointTeamSite.ico.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Paint3D.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\180.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\3DViewerProductDescription-universal.xml	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\inktotextengineimm.dll.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-40.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\VariableFrameRateVideoPlayer.xbf	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.scale-200.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-48_altform-lightunplated.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.UnmanagedMemoryStream.dll	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-unplated.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-100.png	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationTypes.resources.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-256_altform-unplated.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_contrast-black.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\networkmanifest.xml.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-white.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-125.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Tools.Windows.dll	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-48.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ThirdPartyNotices.html	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-black.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac	8c153e257e19eafb9010e3808b8b9180.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30_altform-unplated.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-white_scale-200.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-125.png	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\PackageManagementDscUtilities.strings.psd1.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-100.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png.exe	8c153e257e19eafb9010e3808b8b9180.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png.exe	8c153e257e19eafb9010e3808b8b9180.exe

C:\Users\Admin\AppData\Local\Temp\8c153e257e19eafb9010e3808b8b9180.exe
"C:\Users\Admin\AppData\Local\Temp\8c153e257e19eafb9010e3808b8b9180.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
138KB

MD5
4a15c9782b0d8e0807055a760ca66dac

SHA1
d9d0f44ac4cba14510b7c19cb163eb077778b606

SHA256
33b58454cf2806c91016cff8922747df447a469305a4cd4edd3ed0cf1c5222c7

SHA512
bfc7029d04a14524427dc0a7aa38757d303a0f575651cda2b9e03e0212c2492a819d21ebb3b59d9b9105d6df5d17536d778554c6ec121f91a2da176ee9f61951

Download Submit
memory/2320-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2320-4555-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2320-8685-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads