9a75bf1c5e8949df5d70bfc1a521f03bec22b27c7d5916489667e06820fda94a

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29c2f912e49d9a9505c8ea0c75ed72ea.exe
Size

359KB
MD5

29c2f912e49d9a9505c8ea0c75ed72ea
SHA1

1d81b9e266bb789901e18ac00277755a6be8be55
SHA256

9a75bf1c5e8949df5d70bfc1a521f03bec22b27c7d5916489667e06820fda94a
SHA512

64bb7d5aa4c4ea6b38d1af9a7024068c76354c4a98104fa7f0433e74394375f2cd076bf4edced7a2014211fdbe89b8f289b27f6eadf7ebcf1f530a64a3321359
SSDEEP

6144:He+fp7sPSIL3eRIvixTmAcThAkZThMTMfd1E6dqi4py5e:++uSIAIvix1c60yQEy1e

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\msadc\adcvbs.inc	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.sfx	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\en-US\wab32res.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\et.txt	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\desktop.ini	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\Parity.fx	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Internet Explorer\Timeline.cpu.xml	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fur.txt	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File created	\??\c:\Program Files\Internet Explorer\jsdebuggeride.dll	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\gu.txt	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fy.txt	29c2f912e49d9a9505c8ea0c75ed72ea.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sa.txt	29c2f912e49d9a9505c8ea0c75ed72ea.exe

C:\Users\Admin\AppData\Local\Temp\29c2f912e49d9a9505c8ea0c75ed72ea.exe
"C:\Users\Admin\AppData\Local\Temp\29c2f912e49d9a9505c8ea0c75ed72ea.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.9MB

MD5
698f3f1e891e889f604721390b0bae54

SHA1
e6dcc40a667d1c8c4f6788312ea672eb92814f5e

SHA256
1c8e6b3cc4c3d213bbb7833be959353a4ebe5a49edeec62e6ea7c72fc469c85a

SHA512
fd61806e7954dfa03a6698f9cb4106850fc38bc8682fd8562e2deb762cbc2b215fb1a8060d5e71e0c2b627520aa68f64581f0e83bfe7f08243a5f453f06e45b1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer

Filesize
5KB

MD5
6b99099c6a9b959f824e420676fe3dc8

SHA1
ba9e3b5f2f7f710d263272019be5bf5db33bf614

SHA256
34d5d8dc208ef8c73bb46fb3002fa22b8954d52a4e53be3c56b9801aeab56918

SHA512
dfe061ddec4106e68c8ea789009b0e6bf7d27072bebd0bdb724e4ccadd215b9122b04198bbc362753e2b35af16d993ddf89b44b29bb79c0e7a16eeb97f3b3d26

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3000-230-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3000-604-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads