466745be6b45249e9f2d27111d60c751f7b91f42ad8df02d644582e4e0266670

Analysis

max time kernel
143s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03024d17a6adc6151aa9d40f250ddbaa.exe
Size

1.8MB
MD5

03024d17a6adc6151aa9d40f250ddbaa
SHA1

484d372ee89530ac3d2cf1d00d016bb2e4b81c49
SHA256

466745be6b45249e9f2d27111d60c751f7b91f42ad8df02d644582e4e0266670
SHA512

dd5a2f479ba975a6abab9c8b6382882a837825252e8006523f2ed53ced54618edee2f89376d9a29564a328f1c8d754b573949ec052e63f887508c65a57219d08
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHK:SCqm2Jpr0nNM7Dus7Nx2q

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x002b00000001490f-5.dat	upx
behavioral1/memory/1988-578-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	03024d17a6adc6151aa9d40f250ddbaa.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\gadget.xml.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Juneau	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Mail\en-US\msoeres.dll.mui.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.exe	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png	03024d17a6adc6151aa9d40f250ddbaa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.exe	03024d17a6adc6151aa9d40f250ddbaa.exe

C:\Users\Admin\AppData\Local\Temp\03024d17a6adc6151aa9d40f250ddbaa.exe
"C:\Users\Admin\AppData\Local\Temp\03024d17a6adc6151aa9d40f250ddbaa.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
256c8b5670318278536a6ac654c4e75c

SHA1
7f3fd0bd67313acf96eed4e4a286209b197da80b

SHA256
5ea71c03c5dd45931f257d530dae4c7695e5a2c80fcec6a5d351a864c5d2e082

SHA512
9eaa2957b49a98bd6c4b1526d7be834679bacd50a9c2802d806d873fabb05bd2def9d42211dbe1174ffab871685fcfca01213435a6192423147e1cd58ef9bc58

Download Submit
memory/1988-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1988-578-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads