1025a49cc417a4da087d84ba25bc27ae682177e2f46a9f755e847517a08401ca

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a6d5261e5e909f62132215061f8d670.exe
Size

1.8MB
MD5

4a6d5261e5e909f62132215061f8d670
SHA1

035780deb2fabc1c5cc1a68cd06928413d24ca88
SHA256

1025a49cc417a4da087d84ba25bc27ae682177e2f46a9f755e847517a08401ca
SHA512

de171aff09ec2c134863ac53056b8a9bf29ee218585bffbae3422d7e28d161cb0fabe131a9033fd28040cadd27b45f2aaac827ae31b9a5300a6c4d52bf501244
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqVs:SCqm2Jpr0nNM7Dus7Nxz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0009000000015cfa-5.dat	upx
behavioral1/memory/1680-3038-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1680-9204-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\desktop.ini	4a6d5261e5e909f62132215061f8d670.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.exe	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui.exe	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf	4a6d5261e5e909f62132215061f8d670.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar	4a6d5261e5e909f62132215061f8d670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll	4a6d5261e5e909f62132215061f8d670.exe

C:\Users\Admin\AppData\Local\Temp\4a6d5261e5e909f62132215061f8d670.exe
"C:\Users\Admin\AppData\Local\Temp\4a6d5261e5e909f62132215061f8d670.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.1MB

MD5
e6ccc7a6c14f52c2af1db941095d1dc6

SHA1
538b3ea5b76e5816b003ade02adc699afdc6feaf

SHA256
122c9599e0ba4700607103cbd3acf98a000978c188acdef538d4062077fa1227

SHA512
8bcdf8ea026eb026313ef41ecb9716e353b25cb0894bc837d2ad051638a24be914db1175a2bc1d37ed403e14a680b2c34ea43eea6259b1d66530c2918c9f39ac

Download Submit
memory/1680-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1680-3038-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1680-9204-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads