5d093cb7d9d16991d5cea82f3de998abde93a4c1d8a2c00b010477d6e5016026

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f32290440e0a3c1c234de29ebebf735.exe
Size

2.8MB
MD5

2f32290440e0a3c1c234de29ebebf735
SHA1

362d8d594115a81b07ac3c06d9b6459fa7b877b6
SHA256

5d093cb7d9d16991d5cea82f3de998abde93a4c1d8a2c00b010477d6e5016026
SHA512

a5e80064e9587b21f01ec0fbd36b102f25b85b9a9c3c5535c7c107e8ee92eda60dde89b7d110674a90593e96cec617fb8405bfcd067791b10432709a4cce241c
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91H:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x003500000001564e-5.dat	upx
behavioral1/memory/2532-1572-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2532-8907-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\desktop.ini	2f32290440e0a3c1c234de29ebebf735.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\rt.jar	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.exe	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	2f32290440e0a3c1c234de29ebebf735.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.log.exe	2f32290440e0a3c1c234de29ebebf735.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html.exe	2f32290440e0a3c1c234de29ebebf735.exe

C:\Users\Admin\AppData\Local\Temp\2f32290440e0a3c1c234de29ebebf735.exe
"C:\Users\Admin\AppData\Local\Temp\2f32290440e0a3c1c234de29ebebf735.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
2.8MB

MD5
5ce799d80a5bb1f7e77a9dd490b3c77f

SHA1
2ab88a6e29d681fffd7d84586be14657e1dd8ae2

SHA256
6ce9e9fd91ee5861ef002a23d365a5d4099ab57d8a7e848e63e72405a0b04e63

SHA512
62b28bd960d41d1858be6b15f2cee81a253475a58bd96a2abfc1895075f7358b1c77e39dd7d943c3200fb15d7d8de07d61273276a72319d4f0943d650452f2bb

Download Submit
memory/2532-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2532-1572-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2532-8907-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads