ccadbb913e99acc770df436f9f41cb8f9fb91b0ee7f543a04d1ddfe4110e2222

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33dac2e9d3c8b43cc456708b5671996f.exe
Size

1.8MB
MD5

33dac2e9d3c8b43cc456708b5671996f
SHA1

cf11ac05b8d4e051d96ec8ed0c3de89c01904a48
SHA256

ccadbb913e99acc770df436f9f41cb8f9fb91b0ee7f543a04d1ddfe4110e2222
SHA512

ac5a8424ff94f96570ff0f8e7499563ce0f45f60236175bea69647ce2b3827adeed026756ce8c3068cfe337374efa95438535af9f0627b3c05161b222811467a
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqm:SCqm2Jpr0nNM7Dus7NxT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0009000000016ca5-5.dat	upx
behavioral1/memory/2340-3171-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2340-9221-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	33dac2e9d3c8b43cc456708b5671996f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.exe	33dac2e9d3c8b43cc456708b5671996f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.exe	33dac2e9d3c8b43cc456708b5671996f.exe

C:\Users\Admin\AppData\Local\Temp\33dac2e9d3c8b43cc456708b5671996f.exe
"C:\Users\Admin\AppData\Local\Temp\33dac2e9d3c8b43cc456708b5671996f.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
434cead60008e3325b89210b336cc818

SHA1
0fa77e5a9368a5584605865c4bae54bb7190699f

SHA256
ea12e3a86803e9cecbe134619cb002cf5003a6c38f0f583684b84fc2b44fa1a8

SHA512
676d9b6b346153887926d5669a04e425f6aa33abd48bd39453394cef788a15256b8195692809b9258a3b6e10aa21e0fe781617752ac2a2a99d3c292aef93efb3

Download Submit
memory/2340-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2340-3171-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2340-9221-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads