Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 17:11
Behavioral task
behavioral1
Sample
07afe851e7d7d861a6915d634069330f.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
07afe851e7d7d861a6915d634069330f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
07afe851e7d7d861a6915d634069330f.exe
-
Size
1.8MB
-
MD5
07afe851e7d7d861a6915d634069330f
-
SHA1
84babc1253ddcf04ed35c93dce2aefec8095a19e
-
SHA256
3ecc75bc438b90bf227dee2869aad5df858bdd6eab7f41b0af0b0b77b2091266
-
SHA512
1a3317577be10702ddd08ef0cbf1865053a12c4d63f56d8fc19eb46922b3488855eca222ace17e9bb7f0b0b12cb45073cae9f1789721183f4ebd2c014ac0ec2d
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHe:SCqm2Jpr0nNM7Dus7Nx2+
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3616-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022849-5.dat upx behavioral2/memory/3616-1461-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 07afe851e7d7d861a6915d634069330f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Common Files\System\ado\msado60.tlb.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msix.dll 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\TEMPSITC.TTF.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-private-l1-1-0.dll.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\NETWORK.ELM 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Mozilla Firefox\qipcap64.dll 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.INF.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.ConnectionUI.Dialog.dll 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\PREVIEW.GIF.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmsrv_xl.dll.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\odffilt.dll 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 07afe851e7d7d861a6915d634069330f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.exe 07afe851e7d7d861a6915d634069330f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat 07afe851e7d7d861a6915d634069330f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5f7e5960856053b1a71a2f666bf1df5b6
SHA16424dd410aa92e9c9a33b377ef82dca56694bf66
SHA256de015186f701f91604e55ec1263ac7815b581cf6252fae763260f9fa56271f75
SHA512c09a45236cdbec8ebcd1fc72c776e43785f50916e12664f4066efed903639ad567b93d9f4fdc4cc8e3536fce2b51d5a394be43456fe360b847755db8dd09c196