e01ad2386b8f20fc95f5237bdb584dd42bf62b3df6c8d4fc9b72568bd3f38e08

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1097a71b35eea93e5824cc7683dba5f5.exe
Size

22.3MB
MD5

1097a71b35eea93e5824cc7683dba5f5
SHA1

c4f07f2d975bf92a5ba8b01ca5684d3e00e4b969
SHA256

e01ad2386b8f20fc95f5237bdb584dd42bf62b3df6c8d4fc9b72568bd3f38e08
SHA512

dd671cbd8a65c02ace4d0d093725cc67076088245b44bef3c0469a1358459d83a89f057d63b3e69c79caee291f09ef006e9c2f1e0b55bac45dcf22fcfd292e39
SSDEEP

98304:XdrOO536OyLIlsXJfk4pCLNCOEusqrIfU3/SPRXPN4VsCuFQVnmEcPyUMSTSWZn+:VD536OnThlrB3ytPqVxUQVmBDTSWhi

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\DVD Maker\PipeTran.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado26.tlb	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\mn.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tr.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\el.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fur.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\pt.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ta.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadomd.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\io.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcfr.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcer.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sq.txt	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcor.dll	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	1097a71b35eea93e5824cc7683dba5f5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui	1097a71b35eea93e5824cc7683dba5f5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	1097a71b35eea93e5824cc7683dba5f5.exe

C:\Users\Admin\AppData\Local\Temp\1097a71b35eea93e5824cc7683dba5f5.exe
"C:\Users\Admin\AppData\Local\Temp\1097a71b35eea93e5824cc7683dba5f5.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
9.5MB

MD5
6d826b05dacbf0a91be6720505968dfa

SHA1
79e74de5d186635cfc98655e76ea59f95e17f4b6

SHA256
a30e6aa9dd2ae9cf380c02fc5df0940aeedf8fb439f12df0d8303fe15a615bb6

SHA512
f35bc8442887fb09b011f3b531a1287dae1d3dfccf60e90d8e75b5cfc95b85e9d45d1a8ec12fd76e3c022a6d22e1f44c69032c26155ddc2432b7425e6f11eadd

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2028-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2028-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2028-32-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2028-232-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads