04295bf9e3fce76d33cd3dc00a875c350743927545663100aca63066ef171c2b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b5a2b0ed958c8d5babdd33ba46355b0.exe
Size

1.8MB
MD5

1b5a2b0ed958c8d5babdd33ba46355b0
SHA1

b638d8823b9a2ae6cda12ca8aac3ac0f0d2a240e
SHA256

04295bf9e3fce76d33cd3dc00a875c350743927545663100aca63066ef171c2b
SHA512

9af49cd2fd8b4d9a507d65c3076c1cacb9a659234efcc3a2085ab9f07ee9aac0779d6df8cdee20c1f91b1af16ab593812da7ac3a0407348925a08b8060a5c9f9
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqtI:SCqm2Jpr0nNM7Dus7Nx/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2824-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0009000000016176-5.dat	upx
behavioral1/memory/2824-2370-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2824-9204-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Defender\MpAsDesc.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfxrt.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\MoveRename.vsdx	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\bin\zip.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\calendar.js	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\Xusage.txt	1b5a2b0ed958c8d5babdd33ba46355b0.exe

C:\Users\Admin\AppData\Local\Temp\1b5a2b0ed958c8d5babdd33ba46355b0.exe
"C:\Users\Admin\AppData\Local\Temp\1b5a2b0ed958c8d5babdd33ba46355b0.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.3MB

MD5
ea3c1d861e6e8ed2600ed33272e84fde

SHA1
09f05770a721f32a5c74957b58ca580c52c2d20d

SHA256
37dc8769972ddf69b6e5e48c43127f1c6a02e6bb42c5272dd9c028263e615d8b

SHA512
c11c1aaa40702e3ea5ec380a74e683516617bc87be385091b6a3a48807bcd9510600ee5ef1f9cdb67478316937855dcfd0cd0bd10b224e204e9be3caac1d4ec2

Download Submit
memory/2824-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2824-2370-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2824-9204-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads