91ee482e8bbb38af70bd027ddc5c6c10c670bb267e87dd255191e37a6826c7c0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e56eeff2d6b145bf5989282025c4210.exe
Size

1.8MB
MD5

6e56eeff2d6b145bf5989282025c4210
SHA1

f3ffb76c4c7521c2d9942126960c86b5f7952a8f
SHA256

91ee482e8bbb38af70bd027ddc5c6c10c670bb267e87dd255191e37a6826c7c0
SHA512

9659e0fa5bb8710517b7ce628a8e83988772e7ae161f9f364a290ca9c3b7aaaa606d569db47d74f45b9b0d5789fbff25b2d74f009bead3902d4c4db2898a6871
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHO:SCqm2Jpr0nNM7Dus7Nx2u

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0036000000015b12-5.dat	upx
behavioral1/memory/1716-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1716-3427-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1716-9214-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	6e56eeff2d6b145bf5989282025c4210.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Mail\en-US\msoeres.dll.mui.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr.jar	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Windows Media Player\WMPDMCCore.dll.exe	6e56eeff2d6b145bf5989282025c4210.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.exe	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	6e56eeff2d6b145bf5989282025c4210.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	6e56eeff2d6b145bf5989282025c4210.exe

C:\Users\Admin\AppData\Local\Temp\6e56eeff2d6b145bf5989282025c4210.exe
"C:\Users\Admin\AppData\Local\Temp\6e56eeff2d6b145bf5989282025c4210.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.1MB

MD5
e6ccc7a6c14f52c2af1db941095d1dc6

SHA1
538b3ea5b76e5816b003ade02adc699afdc6feaf

SHA256
122c9599e0ba4700607103cbd3acf98a000978c188acdef538d4062077fa1227

SHA512
8bcdf8ea026eb026313ef41ecb9716e353b25cb0894bc837d2ad051638a24be914db1175a2bc1d37ed403e14a680b2c34ea43eea6259b1d66530c2918c9f39ac

Download Submit
memory/1716-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1716-3427-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1716-9214-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads