657e7f4466428dc46d4f5b0d3e7f5518cde0fbf784d740dcf602d065aa36caee

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ee4652602bbed8be07fd317cb17e80.exe
Size

1.8MB
MD5

43ee4652602bbed8be07fd317cb17e80
SHA1

fc044cc424ec51bf6e04ba681529da2e7a56b965
SHA256

657e7f4466428dc46d4f5b0d3e7f5518cde0fbf784d740dcf602d065aa36caee
SHA512

130c67f5615da9bc3733bce811b1ebce6d63a6b86c6df617127b7bbb822e37e1e275258821b9649969782e1230ccbe54bbc9ca852f328f2ff4e9503c033d0daf
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqD:SCqm2Jpr0nNM7Dus7Nxm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2684-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0037000000014ee2-5.dat	upx
behavioral1/memory/2684-658-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	43ee4652602bbed8be07fd317cb17e80.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\MST	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Asuncion	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Guyana	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Halifax	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Perth	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Toronto.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.exe	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.exe	43ee4652602bbed8be07fd317cb17e80.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui	43ee4652602bbed8be07fd317cb17e80.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt	43ee4652602bbed8be07fd317cb17e80.exe

C:\Users\Admin\AppData\Local\Temp\43ee4652602bbed8be07fd317cb17e80.exe
"C:\Users\Admin\AppData\Local\Temp\43ee4652602bbed8be07fd317cb17e80.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
8ac797493dc2080968be21f133164f2f

SHA1
93a05da2abceee8725be5e0d2fc249d814601c99

SHA256
bdcaf34b82370083c3d489aeacd62ddd872bfa3c7d8a89f236f09c5e9f598d5f

SHA512
277fe651046fb511ee31fcba08b6ae4adc0841d82f33cc98de704a97584ee76ed50d0462af08a0d86ff804099584e91a0a309496b0c352b3db484ff040b20786

Download Submit
memory/2684-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2684-658-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads