b23592a6774da805ac101456ac552bae4628e5eca03ef046a01680e08c085af6

Analysis

max time kernel
31s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d3830acd2178cb0519311fc2ba8691c.exe
Size

1.8MB
MD5

2d3830acd2178cb0519311fc2ba8691c
SHA1

b00cd78490bf607a735837ca03f068d5cb597f80
SHA256

b23592a6774da805ac101456ac552bae4628e5eca03ef046a01680e08c085af6
SHA512

f582dd0f0e056f96c1976c159dfafa1a8f2047dfd0b58541c020d26c8a6d451d746c6fa0b209d237dffd9d73f17820cb0c02f38461f922de7397cc49442eb207
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqw:SCqm2Jpr0nNM7Dus7Nxh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001412c-5.dat	upx
behavioral1/memory/1108-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1108-2475-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1108-9165-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	2d3830acd2178cb0519311fc2ba8691c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\mlib_image.dll	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll	2d3830acd2178cb0519311fc2ba8691c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.exe	2d3830acd2178cb0519311fc2ba8691c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.exe	2d3830acd2178cb0519311fc2ba8691c.exe

C:\Users\Admin\AppData\Local\Temp\2d3830acd2178cb0519311fc2ba8691c.exe
"C:\Users\Admin\AppData\Local\Temp\2d3830acd2178cb0519311fc2ba8691c.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
384KB

MD5
2f7fcfd9590f1c2eac2dfac5ab60feea

SHA1
9ea2c49f8c43e4226cc28d54fe8d288e2dd09245

SHA256
3648bc100863acbafe570772da8fc754321493aacb5436d9bddb2095af088762

SHA512
0bc32ce41388dc44a4659ba9e508e1686855971b940d8651b487971d45a81e667ed7adaac6b44705740fd63889f02b8aa4950bc226d46819c053dd7c20803e1b

Download Submit
memory/1108-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1108-2475-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1108-9165-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads