85852d93e462e0240dabde75731e1688e68d304c0b2bf9e4e27972fe6948fb49

Analysis

max time kernel
28s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fe07f76bb9cae50669bb1eb659fb1de.exe
Size

1.8MB
MD5

0fe07f76bb9cae50669bb1eb659fb1de
SHA1

6d7e833edbe6fc06e5a50bac0edf2d14f84e2b3f
SHA256

85852d93e462e0240dabde75731e1688e68d304c0b2bf9e4e27972fe6948fb49
SHA512

34aa91302c9437bd89bdeff79f3fa861e52da1f2860541e532f981cbc290ea53ab74258019314a53015f6b1c8f72788e046c5b23f981b488722c35d0bedb172b
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqF:SCqm2Jpr0nNM7Dus7NxA

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000227bf-5.dat	upx
behavioral2/memory/400-953-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msader15.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\ExpandUnlock.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	0fe07f76bb9cae50669bb1eb659fb1de.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.exe	0fe07f76bb9cae50669bb1eb659fb1de.exe

C:\Users\Admin\AppData\Local\Temp\0fe07f76bb9cae50669bb1eb659fb1de.exe
"C:\Users\Admin\AppData\Local\Temp\0fe07f76bb9cae50669bb1eb659fb1de.exe"
1⤵
- Drops file in Program Files directory
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
466KB

MD5
38396f68f336250271e2107504b2866e

SHA1
9abc5c77c1efdda16543cb9fdde401bad2e1d591

SHA256
f9f4a52884e17244a612aa7006e4a3a6c7d0c3cdfb0e92c026aab845bd8ba2c5

SHA512
916ac9fa46803744e6867a89f9925e34ba2fd7e183dab76ee8214e4658375b0103faf94c8de3430d77744df0894ff0215a818dffd00d1a3dcb927ecf89f59b32

Download Submit
memory/400-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/400-953-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads