22da11341d41a2930e063d902e9227372623d6142d2ad940673055ca0a02708b

Analysis

max time kernel
167s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196d6e6f82c1d4942bab6e82d1a546e1.exe
Size

1.8MB
MD5

196d6e6f82c1d4942bab6e82d1a546e1
SHA1

92f86067ceee059f2288a3a60b9455bf6b5a79f6
SHA256

22da11341d41a2930e063d902e9227372623d6142d2ad940673055ca0a02708b
SHA512

f95c68f5383af2a0571a40e9689bfc4fd7fe6736070d75fbb68571b2bf5ced7371466c5840a97a48a58c02f5606a9b5f21c77bd5466dbace8499f08e90d86bb8
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqX:SCqm2Jpr0nNM7Dus7Nxu

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3564-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022849-5.dat	upx
behavioral2/memory/3564-374-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\FormatGet.ttc	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\BackupMount.asp	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\HideOut.bmp	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\descript.ion.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui	196d6e6f82c1d4942bab6e82d1a546e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.exe	196d6e6f82c1d4942bab6e82d1a546e1.exe

C:\Users\Admin\AppData\Local\Temp\196d6e6f82c1d4942bab6e82d1a546e1.exe
"C:\Users\Admin\AppData\Local\Temp\196d6e6f82c1d4942bab6e82d1a546e1.exe"
1⤵
- Drops file in Program Files directory
PID:3564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
8eca955669c1692f4af97c4dca60fe33

SHA1
4fd2d83bace0b246916de21e1ed666a4120333ff

SHA256
7d7a7d825c9bce6b9ee4c25812fa2af1a20de0795a9f4a273c0825c2793bc056

SHA512
911b0119cdf943a77e0b5a428442e7afb65ca83cef55095401225eaaf621383534548a41d9638cdfcc42bd02ad8dbd4ba83e3a41ec985aa919ef606dc2736e6e

Download Submit
memory/3564-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3564-374-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads