ae7229fd13398862e29c66249ef03a1bde7b2d9ecd6d8db8527c0024f15ccc49

Analysis

max time kernel
174s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112b2846c299fedab175dc26d94916ab.exe
Size

422KB
MD5

112b2846c299fedab175dc26d94916ab
SHA1

17f7dea0407e33e12b3adb75745cabe8b4dfc758
SHA256

ae7229fd13398862e29c66249ef03a1bde7b2d9ecd6d8db8527c0024f15ccc49
SHA512

c80ae9d0c01c1a1b0dcc71b7484b56a42b7258be1c1117f11566dd921ec5a8bda9711ee1976afe1683427b3c44ad08fcb1ff6deb0881cc696a27497f638606be
SSDEEP

6144:Hq+TyiOqzPvuuYe0vucjToXVpGOZchl8HS0WESS:1XdPvuuY9ols8Aw

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-996941297-2279405024-2328152752-1000\desktop.ini	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-996941297-2279405024-2328152752-1000\desktop.ini	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\desktop.ini	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\desktop.ini	112b2846c299fedab175dc26d94916ab.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemCore.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\Services\verisign.bmp	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\System\ado\msadox28.tlb	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nl.txt	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Reader.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\BlockProtect.scf	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tools.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\lt.txt	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\mraut.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\tipresx.dll	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\System\ado\msadrh15.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Debug.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fi.txt	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sv.txt	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.RegularExpressions.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationProvider.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationClientSideProviders.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.CodeDom.dll	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsFormsIntegration.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Accessibility.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\eu.txt	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Xaml.resources.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Pkcs.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat	112b2846c299fedab175dc26d94916ab.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	112b2846c299fedab175dc26d94916ab.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui	112b2846c299fedab175dc26d94916ab.exe

C:\Users\Admin\AppData\Local\Temp\112b2846c299fedab175dc26d94916ab.exe
"C:\Users\Admin\AppData\Local\Temp\112b2846c299fedab175dc26d94916ab.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
535KB

MD5
c48c64a54227760ce71eecf9b9f3e4ab

SHA1
ddc801b2221f1320662826b2d1bd3df7a93e0976

SHA256
deeba901705924fc02ce8909d5d7e75c9519582225625db13c9da811c1a734dd

SHA512
ae6b09ad05d97487f24c65bf7fba225c80a56927be3b7fa4a900f4ba4c6d9e4bdba43412ff72cacfa12ff32859d8c98e8da4801052def0e20662a15ecb955352

Download Submit
memory/4660-499-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-627-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-335-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-369-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-496-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-530-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-635-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-803-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-898-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-900-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-904-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4660-1048-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads