04295bf9e3fce76d33cd3dc00a875c350743927545663100aca63066ef171c2b

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b5a2b0ed958c8d5babdd33ba46355b0.exe
Size

1.8MB
MD5

1b5a2b0ed958c8d5babdd33ba46355b0
SHA1

b638d8823b9a2ae6cda12ca8aac3ac0f0d2a240e
SHA256

04295bf9e3fce76d33cd3dc00a875c350743927545663100aca63066ef171c2b
SHA512

9af49cd2fd8b4d9a507d65c3076c1cacb9a659234efcc3a2085ab9f07ee9aac0779d6df8cdee20c1f91b1af16ab593812da7ac3a0407348925a08b8060a5c9f9
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqtI:SCqm2Jpr0nNM7Dus7Nx/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228cc-5.dat	upx
behavioral2/memory/4912-5391-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/4912-13419-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\desktop.ini	1b5a2b0ed958c8d5babdd33ba46355b0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-100_contrast-black.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.strings.psd1	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-colorize.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderBlack.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-100.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-200.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationCore.resources.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MSTAG.TLB	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-white.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-60.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16_altform-unplated.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-white.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-300.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinOnboardingCommands.xml	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\it-IT.PhoneNumber.model.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-125_contrast-white.png	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms	1b5a2b0ed958c8d5babdd33ba46355b0.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationProvider.resources.dll	1b5a2b0ed958c8d5babdd33ba46355b0.exe

C:\Users\Admin\AppData\Local\Temp\1b5a2b0ed958c8d5babdd33ba46355b0.exe
"C:\Users\Admin\AppData\Local\Temp\1b5a2b0ed958c8d5babdd33ba46355b0.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.4MB

MD5
b8de49eaf9ee100450e2ed37e5fdd2cb

SHA1
9d48119e7d5978b1504815f70a956d497fcfe883

SHA256
bca8227cd12aec187dbd8c6fb294cb74a65df51de0f0b86a53cc0b1006d83cf7

SHA512
63156decf7c2575551bd35ff5404d65a2920446d905232ecc06d1fad62fcddb05376a4c708e96c753aa5ea0908c436473857af9a09d3a115f2d5fc9fb0fa96d2

Download Submit
memory/4912-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4912-5391-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4912-13419-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads