Analysis
-
max time kernel
168s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 05:57
Behavioral task
behavioral1
Sample
09ca397f462d11201a64833fa0e90c70.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
09ca397f462d11201a64833fa0e90c70.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
09ca397f462d11201a64833fa0e90c70.exe
-
Size
1.8MB
-
MD5
09ca397f462d11201a64833fa0e90c70
-
SHA1
f4a9fd4e7025de17b3c8c50e6dbab60484819678
-
SHA256
82ae9e28c019a8669589d7fea701d33ac212053b9edd4c0167363a9ec88dfc34
-
SHA512
231b80ccbf8bfe0b238a20031cca76a71e042134b7a2e42e70decb8ee1c8b590076c994f1cc896aa01a4f9c810661f1a4f8e2950bcc69617817568b7af54e5a8
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqZ:SCqm2Jpr0nNM7Dus7Nx0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2760-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227a8-5.dat upx behavioral2/memory/2760-9-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\ado\msader15.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\FindApprove.mpeg3 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\7-Zip\Lang\lt.txt.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\DismountMove.ppsx.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\7-Zip\7zG.exe.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.exe 09ca397f462d11201a64833fa0e90c70.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.exe 09ca397f462d11201a64833fa0e90c70.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll 09ca397f462d11201a64833fa0e90c70.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD575cb0e0ce87471787f174650697c76e4
SHA16bab4248e5b6e15ecf1c93bfe536822842c37324
SHA25694d43a92b36940f7730ad444a269f6318dd62fc9c1dd7cd13c5ebd803eb36c3e
SHA5125570d38801d3b1937e7c57cd00f24ec718f3fcd4f420aeb14138789519f380ed5c01ec945e254ca307b501cc9165103fc8118244b7f384fc4e19167f530eb958