Analysis
-
max time kernel
138s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 20:28
Behavioral task
behavioral1
Sample
10f86ee5121b000cbe90796f66c54261.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
10f86ee5121b000cbe90796f66c54261.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
10f86ee5121b000cbe90796f66c54261.exe
-
Size
1.8MB
-
MD5
10f86ee5121b000cbe90796f66c54261
-
SHA1
7bd573375e75e332a0c9a43abfd4993114141ff4
-
SHA256
16079d6b8e191943ba818ac0e8f526dec96c8db3fc68c250636e5e3c2db1c39f
-
SHA512
537c519d17e9b17d8c6bff32a590260bff94e6324c23a1948def7928142038caa72a4dee803cc98279a62e19bce7b002b5b4ad0f35ffda948c9b42cff476849e
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqc:SCqm2Jpr0nNM7Dus7NxV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2720-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x0007000000014ad2-5.dat upx behavioral1/memory/2720-233-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 10f86ee5121b000cbe90796f66c54261.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\hu.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\ps.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\tt.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\de.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\History.txt 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\ko.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.exe 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\7-Zip\7z.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\7-Zip\Lang\nn.txt.exe 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\AddCopy.wmv 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 10f86ee5121b000cbe90796f66c54261.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.exe 10f86ee5121b000cbe90796f66c54261.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui 10f86ee5121b000cbe90796f66c54261.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56ae12480a1054da8125ca1ef17bb26d1
SHA1b89954614fe6a8612af67799f32763167cc06f27
SHA25691e4d7944512f79a9f02ec33fb2dc9a26b4c707bec82b8b3c603bc36e762483f
SHA51248ca7af137625e8dd31f000723c2dc3a9fac41ddf818f6166b95de5921140994368f8530b8f0bf45565a629300325e6e6fe31f571919299b0c976d4ea7146619