4b17da2f2ef0b893e7b5f5621d9080f8a7b987dfbcc7cfa6f506a3528ef5e4c1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2eaf5ddb1985264ff2b3e2544d0386ec.exe
Size

289KB
MD5

2eaf5ddb1985264ff2b3e2544d0386ec
SHA1

6ad19a620ded76621305863cdb37fb6c358f4853
SHA256

4b17da2f2ef0b893e7b5f5621d9080f8a7b987dfbcc7cfa6f506a3528ef5e4c1
SHA512

1f53a0c290168f3186ef356bd2b19406e322430a79d7ec74e0332ebfc82f92c7debdb3ab70217130647378ef2ebccd4608b5c01475b7e0a776787a0985eb8740
SSDEEP

6144:Hq+TyiziFmJmxhqYxhk6spHZO8qnuw4kYc+jjMlwX:1Xz8mJmxhqYxhQw8qu/A+0mX

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2eaf5ddb1985264ff2b3e2544d0386ec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadox28.tlb	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\BackupAdd.mov	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msdarem.dll	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sk.txt	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\eu.txt	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\System\ado\adovbs.inc	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\audiodepthconverter.ax	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv	2eaf5ddb1985264ff2b3e2544d0386ec.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png	2eaf5ddb1985264ff2b3e2544d0386ec.exe

C:\Users\Admin\AppData\Local\Temp\2eaf5ddb1985264ff2b3e2544d0386ec.exe
"C:\Users\Admin\AppData\Local\Temp\2eaf5ddb1985264ff2b3e2544d0386ec.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.8MB

MD5
5209a125b259d1ba050a8a155452ebe2

SHA1
0494204fc6770de7cad5af3e7431b62639bd6a46

SHA256
c9e947c65fe93521a9334002719583f3a7b33961b159b28641bc5d6c7e673ba6

SHA512
4fc51c71d5d47dab6e2c6a4c257c1d92ac1e9e265d60f72c2eca68c875955935ef3254b8f0c62b051ed8bc60f73a95f9113c89796f686e7c41caedfc5bc6f14c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
memory/1860-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-234-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-255-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-620-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-1145-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads