c7426d4815ce4ade95ca9fd7c68b05a52966e94c064c99f5ed293f46c6a8fbb9

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64c77b506873e72257c4064f5c6123c2.exe
Size

1.8MB
MD5

64c77b506873e72257c4064f5c6123c2
SHA1

63b9cbb1fc45c5b9b9fbef236918ada3628cf465
SHA256

c7426d4815ce4ade95ca9fd7c68b05a52966e94c064c99f5ed293f46c6a8fbb9
SHA512

698959ce1a9db9da3a191eb01ee97fb78bd1a22c11bccd9d5d806d9520cffef5d701a7d2b39476483a3774a63b652e7cbccf0a2232afe32293a7d3589a1c6fa6
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqy:SCqm2Jpr0nNM7Dus7Nxj

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2292-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228cc-5.dat	upx
behavioral2/memory/2292-6413-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000021e1b-11204.dat	upx
behavioral2/files/0x0001000000021e1b-11206.dat	upx
behavioral2/files/0x0001000000021e1b-11205.dat	upx
behavioral2/files/0x0001000000021e1b-11201.dat	upx
behavioral2/files/0x0001000000021e1b-11203.dat	upx
behavioral2/files/0x0001000000021e1b-11202.dat	upx
behavioral2/memory/2292-13399-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\desktop.ini	64c77b506873e72257c4064f5c6123c2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-125.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-100.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxoutlook.exe_Rules.xml	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.exe	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileWide.scale-200.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\snooze.contrast-white.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-36_altform-unplated.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-129.png	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-100.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-150.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GooglePromoTile.scale-100.png	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-200.png	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-100.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-125.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\prompts_en-GB_TTS.lua	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-100.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-200.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-400.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Dataflow.dll.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.exe	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-200.png	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseEar.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxManifest.xml.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\de-DE.PhoneNumber.model.exe	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-100.png	64c77b506873e72257c4064f5c6123c2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SphereVertexShader.cso	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-200.png	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png.exe	64c77b506873e72257c4064f5c6123c2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.exe	64c77b506873e72257c4064f5c6123c2.exe

C:\Users\Admin\AppData\Local\Temp\64c77b506873e72257c4064f5c6123c2.exe
"C:\Users\Admin\AppData\Local\Temp\64c77b506873e72257c4064f5c6123c2.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
501KB

MD5
0a73f9e35dac663d925e49e6a92ceb7e

SHA1
80cf45a0b1cab70fd8ecaf886881f66a98e62b48

SHA256
e211e467078959b3a7c89ff6ce5907a13c5a82c8162d61ae886909c8178b77d4

SHA512
bd7bd1cc71824045c024b161d4555566bc5566982485bc37a73ee5761d14c745c27057ab3baf5e04e8016ef2c8f291efab322bf8e8f031b76673d8bf78351d1d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
133KB

MD5
5d27a79acbd0fd96794cbaedb0b82b5e

SHA1
7e2e6c53ed1c6285fef81c90fd4482b4d1096222

SHA256
71580b1422a3729f899048da783e0d048f7ee4487cd74d100b30eb765af72246

SHA512
0d2e94663c9803e2f86f63579fe3acdde50d0cca03ca05a85caf72cb12157bec8bd8e2e2bc79de28f57c83ee019ca711cdaeb76513bdff6d9184094250888a5d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
249KB

MD5
a414727f741b67e79b672f8fd55e2e28

SHA1
f483a199c9eb03b937a7885c0d2d345e683d09f3

SHA256
a2c4b2d20b113d31fcc8477613c0f795afbd895d95b3df60b4b32b69ec3894d8

SHA512
88f6379b25428dfdb4f517a571ec27579c92682862ad8eb995e2181ed72e8aeb6bfd6bf4a7ca1048993a40d9f8164b165493abf939e09bcd66bb988e84920362

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
260KB

MD5
e5885c37ef600c45cde24433e07fac4c

SHA1
d5bb27408733b0ed03f57f10e10e08bd19c30209

SHA256
fd742066d2c57093fe7d56d8879cb6cb8488719c8d2d7e2d2d8d5b12e0db8c72

SHA512
4409b1b749e13b8606fb3ce41ce5301d6f610217cff54be1fee403224a8d6a26ce3917215bea81f2955bb0a12fdb5689bc75142c6baf63953fbb099d0101d245

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
231KB

MD5
c341f9a864f70adda895b821e4bd1060

SHA1
b02116542bf5ae8865a791f183f3f4970c0e53a8

SHA256
a53dd5547ae046ee5f0bcc584d014dbe03ed89dd42f9962b52df6e9596702625

SHA512
04b08ab7263a5f32c77b9228ff0b54f58577ff23293cb9230343d734e9a6246b6fc2b87f21402028548628d0593ad9d66fa4e028b9a988c94ead435364f5245c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
280KB

MD5
616e4512e3c5c106836b226cb57755a2

SHA1
b44f9ecfc9c7872ffaf94818d975ad19e8bf3dad

SHA256
eb28142d51327123c9efb7d5bc009730b95c1a2ea7c70256f1b4bcfc2f1b0482

SHA512
9ecbf398041348046cf7f9f8f2a7162b2af0c0ad99c49aceac27f0454e943f06b2643744d712e4f54c1721ecea841154774f0127e55aad042d29730a36b7cae9

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
325KB

MD5
b6824b1be6e9c729c1f7b24b3a59a793

SHA1
00374881619cbffa90d6216b145ac40aad438929

SHA256
7d95d55ca8acad037c428ff3f6923a163de91d47020b84f4fcf7e1c355de8109

SHA512
e37727149882a5de352e1f1ebf07d30432bbf06fffcd67f36ede83a262cec6a16d5653699bf7b0ff42059789bc151683bb42cb99fd12227b75a7dd8ec65f4311

Download Submit
memory/2292-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2292-6413-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2292-13399-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download