9943784f3aa08e1a981dd5d97ede8011cbd70822fd020dea9149a82c67f4948d

Analysis

max time kernel
146s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1389b88c1c41504724f4e4f8ad1632ce.exe
Size

1.8MB
MD5

1389b88c1c41504724f4e4f8ad1632ce
SHA1

f95ea02687679f9b3987f1e96c09d92c4210c85b
SHA256

9943784f3aa08e1a981dd5d97ede8011cbd70822fd020dea9149a82c67f4948d
SHA512

5f0e86f3e1b65db35223f1e11dacefd5dc54c8786facabba2e685a78f98fe0defdabe293bc524e9e62b78dd815f9bf39cee945a82486e854637775ca5698ec69
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH3:SCqm2Jpr0nNM7Dus7Nx2X

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0012000000015c2f-5.dat	upx
behavioral1/memory/2240-656-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	1389b88c1c41504724f4e4f8ad1632ce.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Resolute	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos	1389b88c1c41504724f4e4f8ad1632ce.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.exe	1389b88c1c41504724f4e4f8ad1632ce.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template	1389b88c1c41504724f4e4f8ad1632ce.exe

C:\Users\Admin\AppData\Local\Temp\1389b88c1c41504724f4e4f8ad1632ce.exe
"C:\Users\Admin\AppData\Local\Temp\1389b88c1c41504724f4e4f8ad1632ce.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
92KB

MD5
94d0a59e3e1f8034cf928876b525b2e7

SHA1
30600a6adaa67b9869a92bdcd1fa14b38632e150

SHA256
ed4e1966cd563d7725bc4d87fc6c03e4f2c170a015dc364b4ab9dbe923de852c

SHA512
42d76e865408a314eac1a5158ec5b09058b07b0672ae4850e495ab029b40115e52037bd0248ddf546139aee00a78b442dbee2b5e56bf5653c42d45a5d64271bf

Download Submit
memory/2240-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2240-656-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads