82ae9e28c019a8669589d7fea701d33ac212053b9edd4c0167363a9ec88dfc34

Analysis

max time kernel
25s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ca397f462d11201a64833fa0e90c70.exe
Size

1.8MB
MD5

09ca397f462d11201a64833fa0e90c70
SHA1

f4a9fd4e7025de17b3c8c50e6dbab60484819678
SHA256

82ae9e28c019a8669589d7fea701d33ac212053b9edd4c0167363a9ec88dfc34
SHA512

231b80ccbf8bfe0b238a20031cca76a71e042134b7a2e42e70decb8ee1c8b590076c994f1cc896aa01a4f9c810661f1a4f8e2950bcc69617817568b7af54e5a8
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqZ:SCqm2Jpr0nNM7Dus7Nx0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022897-5.dat	upx
behavioral2/memory/4940-6042-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x000100000002182d-11180.dat	upx
behavioral2/files/0x000100000002182d-11178.dat	upx
behavioral2/files/0x000100000002182d-11179.dat	upx
behavioral2/files/0x000100000002182d-11177.dat	upx
behavioral2/files/0x000100000002182d-11176.dat	upx
behavioral2/files/0x000100000002182d-11175.dat	upx
behavioral2/files/0x000100000002182d-11183.dat	upx
behavioral2/files/0x000100000002182d-11182.dat	upx
behavioral2/files/0x000100000002182d-11181.dat	upx
behavioral2/memory/4940-13430-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	09ca397f462d11201a64833fa0e90c70.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.exe	09ca397f462d11201a64833fa0e90c70.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.exe	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms	09ca397f462d11201a64833fa0e90c70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml	09ca397f462d11201a64833fa0e90c70.exe

C:\Users\Admin\AppData\Local\Temp\09ca397f462d11201a64833fa0e90c70.exe
"C:\Users\Admin\AppData\Local\Temp\09ca397f462d11201a64833fa0e90c70.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
64KB

MD5
2bbebb4ae5ec4524323a2a6514d02eb0

SHA1
d3725c6102312d36da5a9d2b3c931f89a607e81a

SHA256
9a2127a891b447292adce248eef70ee502be1b5768a03ae9807f7a51b22d414f

SHA512
5c3dfb69941f344adc59c14bff696c10fcdc90f04c978336592a962b23508741abb962b5ca5130092aa719113a7e2efc45a15dc395d8ffe08a3a5896af23c031

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
5KB

MD5
40d56ad8e7a8eeba1045642de126dee1

SHA1
57f0725591011b25e359f12745380562ba71313e

SHA256
07a1a63da825c3bb92fb8effe92af3236ac124f9a9dbc29766444fa60ea3d6bd

SHA512
18b70ffedc3b1e71e1bfcd742b07818d456c8efe512723f88ff6e9a7e8be256b980b0a8d87b5d2db1f08b42345560f8f022a0604b747b57f6856552077d459ab

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
124KB

MD5
91f3e68336ae74f339e7c3da2497be3e

SHA1
ad5d244571c219952f57a6a6093d4ed65890eecb

SHA256
cb213a9d4b9850c8da7ddf6200b2dd72bd3cba5e34e7c8dcb8129e96b881d739

SHA512
025cfcb0030f1238de97df8f30b86457646e9d33bde8352d81b5f3774daa1b754018ebe9f372c77b2ade44bfb02f69ba447a84eb69e141ba8a33b6d40edf3f14

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
107KB

MD5
97afd89f536d7b4ade22127a360bf643

SHA1
0edc30a73b5f28649430a85e055afb9867fc83c0

SHA256
ed8a35976a6da6728f55e5047389368bb6274a705f3b5fbbd114a6fe23088863

SHA512
98a9a240d2b5e8d75101d8500e838f879842d5ffb8558ef213c83a6e566a0652111c31e8336245a19717b63aca82bee63c257c20e2e948088c8cb5787394cf7f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
39KB

MD5
7bd73b70b8d1d3ae57aa6f8ad971b12c

SHA1
a2e702eb0bd4d191c2034be64155e416c558d74c

SHA256
576aed7adc607ee1ae5d13db4e880ca108a1e8d689a1be68bcba9d64bf075c3f

SHA512
f0cd5873290be53bab0e3686fd4df4b73cd5c8c7e28f4f92ec7a95550b76c493118f12a91c29f38d8b3cbcf20143420f02142ab83ab98140d6dc342abce4b463

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
31KB

MD5
a3d37e5359e36d70dc4c6f419b0258c5

SHA1
d80891c51e613b562ef04c8096002510eaee94c7

SHA256
c91aac6c1b036f999617a42426add70f3f05271ff685a96958ccf113596ab907

SHA512
6a0c71b820396e610f79f29f06fab61f7c16101849e9dc9bb80324a2f74fc14522d8551da5884694692c8a8f21ebba8e3ffe0e298b6931549ae0e50c27643364

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
86KB

MD5
adcef900f9bd4ea77c12e09131416dff

SHA1
d34e0b29a498f34189c40e6435ad270d7457cc5c

SHA256
63831028ad28764ab590f617ebe430b9220f81434f9c93f799ec3749520b43bf

SHA512
98c748c0971bdd9b5a7734ce34b0215f08d47a3247748df2b054a91c642daeee1e0112bb47400dc89695a40c8a2e56892822e27707588e56a530304c60b9ad31

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
19KB

MD5
3ce1c9652c51e0b933cbd5d8a5f902f4

SHA1
e5e47d2b953a402ba66c010b04d1633a87b2b3fe

SHA256
5bb8617a2818d2b828d20ab06cb3f6ea4e941144537a4eb08aecb940147b3de3

SHA512
bcff5a26810c0fc55a3f71c873ef258ac164a0f1ef1ebc6c01cb2fa7c188910fd3b74b76491eef651de108f90926baaf188ab2f68f4a89506ea5eb57bd867ebb

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
43KB

MD5
f9dc1a9583b07ef0226a68d5435a5b1f

SHA1
5a85996148010794b02df01caa623dfb0d97170e

SHA256
e7c98be526f09749bcd41415f270f69e6af108f4fbbe05600f74616ca3e0d938

SHA512
f24f6ca38cbeb198d294235e8aac8e479d6e05ba6ce040ac52de987fb66e74994dd1f6c98eee8f8fc4e3c99587466335c28651c55d315877b9089630a39c2951

Download Submit
memory/4940-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4940-6042-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4940-13430-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads