6217334c9c36d7e8b905d6598ea190d8cb5ed7c183218a25f0e6297284ebb319

Analysis

max time kernel
165s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eb40b9816d2ea473abcdacd143c571d.exe
Size

369KB
MD5

3eb40b9816d2ea473abcdacd143c571d
SHA1

4330878d979c9a82252c55e87c19637d7bf37e07
SHA256

6217334c9c36d7e8b905d6598ea190d8cb5ed7c183218a25f0e6297284ebb319
SHA512

52a788182a9b6ba543dbdcdfa1ed16ae46caa22cc5c838f2e644cc070f7848129132eab4e5db9e598d3839c5a45d3d78dab9d59591c51656c5edb600fcd89f21
SSDEEP

6144:He+fAz16PHy4mir6ideW83gPZ4Jgk/e3ocVRM9egLQa4T1FUZ3ogcNql/xAbQI8q:++Iz16fDr6isWyuZ46k/e3ocVRM9egLO

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\desktop.ini	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\desktop.ini	3eb40b9816d2ea473abcdacd143c571d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.AccessControl.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationTypes.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadox.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\ReachFramework.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\msvcp140.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.Lightweight.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\joni.md	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Cng.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\rtscom.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadox28.tlb	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\glass.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\legal\jdk\cldr.md	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.CodeDom.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Claims.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationFramework.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\mr.txt	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\jce.jar	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\calendars.properties	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\System\wab32res.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.OpenSsl.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClient.resources.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tr.txt	3eb40b9816d2ea473abcdacd143c571d.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	3eb40b9816d2ea473abcdacd143c571d.exe
File created	\??\c:\Program Files\Internet Explorer\iexplore.exe	3eb40b9816d2ea473abcdacd143c571d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3960	456	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\3eb40b9816d2ea473abcdacd143c571d.exe
"C:\Users\Admin\AppData\Local\Temp\3eb40b9816d2ea473abcdacd143c571d.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 804
  2⤵
  - Program crash
  PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 456 -ip 456
1⤵
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
481KB

MD5
9a8ebb015d230316289a4b86a35d92b5

SHA1
9b0b13efa2b275475504523ae877194f3111da5a

SHA256
76ee45b3855a97892aa4f52e6723d7504ebcc0c6b1d37993da6f42894ca69cdc

SHA512
e80c30da9adbcccc41b0355ad9043014c59d53fda39dc9122ce1c92de2070a50fa1d7b47c642ca919f063003323ce641a3116b91a9dc8d133e4b325aa1349865

Download Submit
C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/456-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/456-877-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/456-1999-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads