493c531793b69739ec7dbcb63c19da7e927b7c73241c5bec8abdf94c68d76205

Analysis

max time kernel
32s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c82c542b507687edcd02006566eb15.exe
Size

266KB
MD5

69c82c542b507687edcd02006566eb15
SHA1

62f2badc7206692772dde9b10c1d5f21a29086c3
SHA256

493c531793b69739ec7dbcb63c19da7e927b7c73241c5bec8abdf94c68d76205
SHA512

48739dc637f45d7c0fdfda44da31fe4f7c03768fd813d7d8a7d68c971acb03ce7e40ee1afc8b694f5ddeddd9aaf2abbffdb600c5974a5f6e2e9e390f8fb51538
SSDEEP

3072:BnEOei99xNKk62SexOQtW+piWzzmSFKx1tkWcljikMTmAcThAkZThMTMz6s:He+fAmpHx+ajixTmAcThAkZThMTMj

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\desktop.ini	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\desktop.ini	69c82c542b507687edcd02006566eb15.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\an.txt	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\da.txt	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\adcjavas.inc	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\gl.txt	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorlib.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\bg.txt	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\oledbvbs.inc	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-profile-l1-1-0.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\kab.txt	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.NonGeneric.dll	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msdarem.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\si.txt	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\adojavas.inc	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	69c82c542b507687edcd02006566eb15.exe
File created	\??\c:\Program Files\Common Files\System\ado\msador28.tlb	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui	69c82c542b507687edcd02006566eb15.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	69c82c542b507687edcd02006566eb15.exe

C:\Users\Admin\AppData\Local\Temp\69c82c542b507687edcd02006566eb15.exe
"C:\Users\Admin\AppData\Local\Temp\69c82c542b507687edcd02006566eb15.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
4KB

MD5
e728c67376c9f4110cdb710ffd96ce77

SHA1
9c0ba9ab195a96ec771a15801159264c25c8c0cc

SHA256
771567c310a9d94fb74d4299273c11eb1f09daa59f029853cf45e162a00e5d4c

SHA512
a927b9e0a4e42b9c17f8425007c09d585aac5a1d151234e3505c0cfb6acf229ecdcd3f3589909f481ad70ac443fcca2bf9e3bdd4969aa59f794e2ebe59379e32

Download Submit
memory/4916-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-795-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads