Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:13
Behavioral task
behavioral1
Sample
1888142ab0f066b5c3181bd6531cbb74.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1888142ab0f066b5c3181bd6531cbb74.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1888142ab0f066b5c3181bd6531cbb74.exe
-
Size
1.8MB
-
MD5
1888142ab0f066b5c3181bd6531cbb74
-
SHA1
b0b9ea75b3e01201dd74d31c1a6c1f5cba191654
-
SHA256
f87d8f4008165c2ad5105bfed0c10ee3dc3df1ab096e2fa1e6930c61da51b78d
-
SHA512
435880d5bf6923da6b1173ca6927dece030b854935e33c0075a502f16876de3397cf0038eedbf36f0486cb26bb724775cf6e22e4b855c12d03932491caa08cb5
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHW:SCqm2Jpr0nNM7Dus7Nx22
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3016-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227ab-5.dat upx behavioral2/memory/3016-269-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfxswt.jar 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\7-Zip\Lang\ext.txt.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\7-Zip\7z.dll 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\README.txt 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.exe 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\classfile_constants.h 1888142ab0f066b5c3181bd6531cbb74.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.exe 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms 1888142ab0f066b5c3181bd6531cbb74.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD560c7d769ca6f71d1c2a10156b4067b62
SHA1fee6a76fd6b40b2d5ea9fd06e099f5e531a5c68d
SHA256403297ea7efef8f2a2caccbf090b09151f82b9cfff1d76636109090e27f29f61
SHA512da78efcab26b1ab0f18b62ddd697a348206fb518ddcb541ce0c7c6fa1e9c9a7c860bf591a20b0b310c0daee7f1b653356c2021ce4c0886635512689b86946017