42bc0a86fc196f529a68f020552d588ffc420b1865edc9d7cfe96343f7f745f6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3175db19e3653a9d5a01d3ec34376860.exe
Size

1.8MB
MD5

3175db19e3653a9d5a01d3ec34376860
SHA1

0c3381faeab351997733e7e2482c3ea46a919c35
SHA256

42bc0a86fc196f529a68f020552d588ffc420b1865edc9d7cfe96343f7f745f6
SHA512

20417211ae4c0825f871f4ee735ec263b9e00b2265fec6a6bf6471d3f3f3adc771817a7c6e4f2d1b3d4634dcf543ce359d8bc8f3dd2cf844d8f20f15bd24dc12
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqyW:SCqm2Jpr0nNM7Dus7NxVW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2996-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0032000000016d05-5.dat	upx
behavioral1/memory/2996-3057-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2996-9203-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	3175db19e3653a9d5a01d3ec34376860.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\PST8PDT	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\gadget.xml.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\calendar.css.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jre7\lib\security\java.policy.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozglue.dll	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.exe	3175db19e3653a9d5a01d3ec34376860.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.exe	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo	3175db19e3653a9d5a01d3ec34376860.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json	3175db19e3653a9d5a01d3ec34376860.exe

C:\Users\Admin\AppData\Local\Temp\3175db19e3653a9d5a01d3ec34376860.exe
"C:\Users\Admin\AppData\Local\Temp\3175db19e3653a9d5a01d3ec34376860.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
335f535143dfd224b1ae1146f4410ad5

SHA1
62a8f0f248c97ead2e11ae32b82eccbbb87afe09

SHA256
998c0819d99dd6faaac7cbe6fdb179dce2629a655a646cc0788b5177e9e087dd

SHA512
cf33951f275d899c68cfa3d48bf37bd4b4398130f46bc25b4f395786582aeab430ee58979a42b9a3c4014a07e5253d7d5ef3026d846b6d98d7dd2481b29026ed

Download Submit
memory/2996-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2996-3057-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2996-9203-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads