Analysis
-
max time kernel
4s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 10:32
Behavioral task
behavioral1
Sample
67816b7b5059bac9359b0e3eae3f2997.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
67816b7b5059bac9359b0e3eae3f2997.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
67816b7b5059bac9359b0e3eae3f2997.exe
-
Size
1.8MB
-
MD5
67816b7b5059bac9359b0e3eae3f2997
-
SHA1
71b7f82989922e2e7e109b675df6e8efd324ad15
-
SHA256
f8ac3f7baff2901e3a45ab49251a946f56cd7c69d6099fe8b828b43123cb1f5f
-
SHA512
60478ed610ce975aac9b3043f68dd0ffb6271befb26ab0cc014a935d0ea0f98152e8581bc72bf975fd6e2b56722ab9150402b641d7d190852fc540195196d678
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq+:SCqm2Jpr0nNM7Dus7Nx3
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4316-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4316-5144-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4316-13411-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\7z.sfx.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\descript.ion 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\tt.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\mr.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\uz.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\ado\msado60.tlb 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll 67816b7b5059bac9359b0e3eae3f2997.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe File created C:\Program Files\7-Zip\Lang\nl.txt.exe 67816b7b5059bac9359b0e3eae3f2997.exe