56d985fe6ab20ba339bb60d12a8f078f343634a9eb15d507b8fe33f2f424ab0e

Analysis

max time kernel
161s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59a719b51e23e6d54bf36261cab9b5b4.exe
Size

1.8MB
MD5

59a719b51e23e6d54bf36261cab9b5b4
SHA1

07a30dced7ed6eea798c0b8bed1ee338b4fb46dc
SHA256

56d985fe6ab20ba339bb60d12a8f078f343634a9eb15d507b8fe33f2f424ab0e
SHA512

54ee34408f58d3d4c5bb45f557d312cf5b03ecceaea50b1cadb561be03052c566e7209505c61091b8da7e3743033f3cbb0f91ae30ffb9d7c9e04630dfdb87020
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHw:SCqm2Jpr0nNM7Dus7Nx2Q

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1584-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000227bf-5.dat	upx
behavioral2/memory/1584-911-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\management.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	59a719b51e23e6d54bf36261cab9b5b4.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.exe	59a719b51e23e6d54bf36261cab9b5b4.exe

C:\Users\Admin\AppData\Local\Temp\59a719b51e23e6d54bf36261cab9b5b4.exe
"C:\Users\Admin\AppData\Local\Temp\59a719b51e23e6d54bf36261cab9b5b4.exe"
1⤵
- Drops file in Program Files directory
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
531KB

MD5
084b78662872178f0d469744914d8876

SHA1
6c35c2e5a847d149090f872a67627be6d84dc644

SHA256
49ff37e6a6bf35346e4e8a89a8429ded1e69af21b420934cf81ffbc4cbe5bf49

SHA512
8e4f4959773cb8b0e63eb47a1c7e527e60d51b23d4b1a5c51f13a0a12bc8c2377d3ecfcd29680d108d009a423f0c4e1e4f670c3cd234d89a6af4d15977f829a7

Download Submit
memory/1584-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1584-911-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads