bbc2f1939fcca587b3a3bb2bda2f19f0fb4a2136f677e195888a899fa03fb87f

Analysis

max time kernel
143s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

042da9629378a39e8cf9e864ad3e1672.exe
Size

2.8MB
MD5

042da9629378a39e8cf9e864ad3e1672
SHA1

d829ac2ae7a9552068c5c22131556b1ea99b7c86
SHA256

bbc2f1939fcca587b3a3bb2bda2f19f0fb4a2136f677e195888a899fa03fb87f
SHA512

c5525b941e8c6ad13a7fc743a20cd158ef19ce1388e2cdd668e8a4f7c23be00287748cba1ee8ac9eb6b24cae429adc62fb94467e3ce0ce7dd6de9c51f0e11f13
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91u:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0na

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0029000000014b90-5.dat	upx
behavioral1/memory/2624-485-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	042da9629378a39e8cf9e864ad3e1672.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\ConvertFromSend.vsdm	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsoundds.dll	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jre7\Welcome.html	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jre7\bin\libxml2.dll	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.exe	042da9629378a39e8cf9e864ad3e1672.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.exe	042da9629378a39e8cf9e864ad3e1672.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar	042da9629378a39e8cf9e864ad3e1672.exe

C:\Users\Admin\AppData\Local\Temp\042da9629378a39e8cf9e864ad3e1672.exe
"C:\Users\Admin\AppData\Local\Temp\042da9629378a39e8cf9e864ad3e1672.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
2.8MB

MD5
9c8aef7547b5a50b900912fdad4b9c8d

SHA1
27ac4616a9881e5b6da74252bb85ae1ff186ad77

SHA256
afa0fe53a9f33b12b06ec942e3fca61c82248264f36ede5ac320f953685ede5f

SHA512
a0405249c4d89e33be1360d12d9de4718f5c2e64b564d5359720c590b60fe94ea6ac7e6f4f8ac4c2bec467a9b243feb51294c58311e788559fb2c2628a0c883e

Download Submit
memory/2624-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2624-485-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads