e2a15b2036d73b720f54e4b77b2a0b8a7909423b9e7c39b70fe7388a2075958e

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f432908e4fba546594423dae70c3be0.exe
Size

1.8MB
MD5

6f432908e4fba546594423dae70c3be0
SHA1

7968e085bdc19cb8e1762a170a7d1e5a39dd6c01
SHA256

e2a15b2036d73b720f54e4b77b2a0b8a7909423b9e7c39b70fe7388a2075958e
SHA512

8fc92c3697b8116682d719e00328db593cf192c8f35bf914f015dc5550aa645f8208dbcba676cac42e9328afc2cf03ffa5c86119693f6bcd93844fa699e60602
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqOj:SCqm2Jpr0nNM7Dus7Nxvj

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4284-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228cc-5.dat	upx
behavioral2/memory/4284-4789-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/4284-13379-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	6f432908e4fba546594423dae70c3be0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent.dll.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.exe	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\PREVIEW.GIF.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-125.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\avcodec-58_ms.dll.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-150.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Coverage.ps1.exe	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\LargeTile.scale-100.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-125.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxSignature.p7x.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Retail\NinjaCatOnDragon.scale-100.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_contrast-white.png.exe	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLogo.scale-125_contrast-black.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-24.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-150_contrast-black.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\resources.pri	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OCLTINT.DLL	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Heart.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportError.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-200.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyVideoProjectCreations_DarkTheme.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-125.png	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SearchPlaceholder-light.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-200.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-63.png	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\40.jpg	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\DemoNotebook.onepkg	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-lightunplated.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\TentDialogDesktop_456x100.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-72_altform-unplated.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-336.png.exe	6f432908e4fba546594423dae70c3be0.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-125.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-48.png	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.exe	6f432908e4fba546594423dae70c3be0.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll	6f432908e4fba546594423dae70c3be0.exe

C:\Users\Admin\AppData\Local\Temp\6f432908e4fba546594423dae70c3be0.exe
"C:\Users\Admin\AppData\Local\Temp\6f432908e4fba546594423dae70c3be0.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
118KB

MD5
da5ef0ac8b9be86f384dd31c96d4ec4d

SHA1
b63b4efd4de21bb0169f3fca9d21433f82b57b0e

SHA256
221c02f081ea2060d5d601311b33a52cc6028374969c7e3e57eaef86924fa34d

SHA512
c03d9c86df279a411debdf616c543a71b6d0ace26e2129cecfab7dc9ed773c955cdaef2a7fae9df60449e82258963499c4d871ff429a183e6ddb42a7da0a63af

Download Submit
memory/4284-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4284-4789-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4284-13379-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads