Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 12:17
Behavioral task
behavioral1
Sample
1daffe582a4282426929ba8ed3187c99.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1daffe582a4282426929ba8ed3187c99.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1daffe582a4282426929ba8ed3187c99.exe
-
Size
1.8MB
-
MD5
1daffe582a4282426929ba8ed3187c99
-
SHA1
08a53c234d2c1b26b3d23c7c70270b6b13b64f26
-
SHA256
dd15067f88aca14be763e2c9fd29e3b8e7c1def18fe235b1a80c7b8f53b11f40
-
SHA512
99cefa97a25bfe2b49d6731c66eb9e172deb07c6c44c9cfb21b6daeb7555519e097a7e72cb83c1717b17de979e1a200128b2ee436ea7b461d65160dc9e28110b
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHL:SCqm2Jpr0nNM7Dus7Nx2r
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 3404 Process not Found 3404 Process not Found 3404 Process not Found 3404 Process not Found 3404 Process not Found 3404 Process not Found -
resource yara_rule behavioral2/memory/2240-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228cc-5.dat upx behavioral2/memory/2240-5443-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0001000000021e1b-11197.dat upx behavioral2/files/0x0001000000021e1b-11196.dat upx behavioral2/files/0x0001000000021e1b-11195.dat upx behavioral2/files/0x0001000000021974-11200.dat upx behavioral2/files/0x0001000000021974-11199.dat upx behavioral2/files/0x0001000000021974-11198.dat upx behavioral2/memory/2240-13441-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\desktop.ini 1daffe582a4282426929ba8ed3187c99.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-400.png.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-400_contrast-white.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.WindowsRuntime.dll 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\ChartIm.dll.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-200.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-white.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200_contrast-white.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxBlockMap.xml.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-32.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-unplated.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\6.jpg 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-24_contrast-white.png 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-16.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-20.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-100.png 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\FM20.DLL 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\VBAJET32.DLL.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxManifest.xml 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-16.png.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-lightunplated.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-125.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.HttpListener.dll.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\xmlrw.dll.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_HotelReservation_Light.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\3DViewerProductDescription-universal.xml 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-32_contrast-white.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Access.dao.dll 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-100.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-lightunplated.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-64_altform-unplated_contrast-black.png 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_contrast-black.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-black_scale-200.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-white.png 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-200.png.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.exe 1daffe582a4282426929ba8ed3187c99.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png.exe 1daffe582a4282426929ba8ed3187c99.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NetworkInformation.dll 1daffe582a4282426929ba8ed3187c99.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD549b1b768bf4378fcb0638bd6efa97d89
SHA1fb07dafe62970a216bcfe25aa8b54c3d9f813479
SHA2566307933528929262774b3b00fd25a5fb847bbbb446594b6da508b9ef3beb8d8c
SHA512432509099e3de6cd50c49fa442ed091f8be7fc5552563503961b5383c0832ea3179db04375f12113c0d5899a73333140ef645cefe0d32290c85f5202479eb803
-
Filesize
121KB
MD50f08833bbd688de184c5b87785119b25
SHA137ece876b177c3c8878bc088a8b7c71646dbda3f
SHA2562e72b23a161c999da375a8212e82f80b4de0c7865f73d416dc2789ae9e28cbb2
SHA51224cd1b994a99f127e6c269c4482bd495233e40e6e0d42de147e83d1061d3a1e7a7a290b997157a1d03c2fad27b3f2e625f462a2c787bb7c74fac6836eaf115fe
-
Filesize
146KB
MD5b192a2f8af0fbd8c07223816ace41e88
SHA14e8f4d1b1b27174415ad5bda59fbdb41dbf5b4c6
SHA256fb01d1e811dd39e6004da27dd6ead55043aa1f99a5c77247cc22758d2d71a205
SHA5123cd0fec81b96918971d5eb57ebf2c34d9a05ec823d8fa2de95efe52add6318fe232b3152aafec742bd3123ddde3b85cf6642843df5928f48f1b0532f376ec2a9
-
Filesize
162KB
MD5793023c2a83f0a1f8357f5b9042ab330
SHA115203d71c32e6bb8bcbaa92a63e8f5dc6147b028
SHA2567de531950551dc7a233c5faed204c44092dcf8421bfeb7fd739dbc27c48b59d4
SHA512ebf5f2e86bdfd0283f9fb2646b1975a3b341dadb9ecf53f4f216aff5938241a0d3435c207a64a70ddf6bb95864584bd349a6fcccf08d8ffe4b5cb8166abde767
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize75KB
MD52ae7c570ed388d24c7fc3034d1efc591
SHA1beca63819553cbd6a2215b604246a04fcc1c371b
SHA256fa0aae1031146ee557aa2fd94ffdf20ebde5db7d5b758a8af4bf0a0945f02550
SHA5129c375b2997260a1f319ddfdc7342cf31ed9ecb4e68dccea9a141dc24309e327c03225a50e95524393a942d4c1a0baf67791aaaf55222a0d56d422c5b1174169a
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize69KB
MD5b1ff53d918cd49e39a685e96f08fcbf6
SHA132d38f80d2f8bf4a8971638209e97d3a1bb8ffec
SHA256a60db650ccf9273521d018322436054133903ffa96103cbae77cb621706d32ca
SHA5125164fa3b7bec3aa23311af416142b93eaf503c692132ef06784366a26f72439085d6b560bf25a08f35077fe61159dae933c5a3b24f7db0de8ec4fbaddbdb7c06
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize225KB
MD506c41b458a2664462ae7214a02ead6f2
SHA166a16d4e0853490013e0b49d6f23df138a912337
SHA256c3d7ebe25a7d1303c54cb56594d6d0d4e27f918448d7336a13e71e99a21491f3
SHA512808864bfc6d7248a8e17542bc5a88b387af98ab26fc34428d09441562761a9318ed6c6788b2f6a21d7794c4e867d2a184804a05e37a0687edef6924d7cf22a20