2643098117c57e56067b89c45d20190de8d8529b4f276247395149b92017267d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0537caf79a371edf0ea6222d9408accd.exe
Size

1.8MB
MD5

0537caf79a371edf0ea6222d9408accd
SHA1

0b68188d461cca776fb450c59c2f3ba264969e0e
SHA256

2643098117c57e56067b89c45d20190de8d8529b4f276247395149b92017267d
SHA512

19a8a30e5851a1cca5af5846db8fcdb84f582f287d227a14580bc3e7a2516d186d7053a36e91ae30d417e58d6109b943a485b561cb663b45a5b2fe5df0b4dbdc
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqu:SCqm2Jpr0nNM7Dus7Nxr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0009000000015d23-5.dat	upx
behavioral1/memory/2992-3013-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2992-9188-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	0537caf79a371edf0ea6222d9408accd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\ShvlRes.dll	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Guyana	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.exe	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera	0537caf79a371edf0ea6222d9408accd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.exe	0537caf79a371edf0ea6222d9408accd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.exe	0537caf79a371edf0ea6222d9408accd.exe

C:\Users\Admin\AppData\Local\Temp\0537caf79a371edf0ea6222d9408accd.exe
"C:\Users\Admin\AppData\Local\Temp\0537caf79a371edf0ea6222d9408accd.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
102KB

MD5
fd71e2dea3cd42d50368e3593c149cb8

SHA1
2dee77db86214610a82cab81c9786c89986c68cc

SHA256
7ff5a10bb4bf5bc40259fa469cb9f51925203a011d9cad22f7ffc5835d979a8a

SHA512
bfdc67700f37cec8344288b39cdc13e459a23da6cbbeec7b1d1cd96a8fc5421428ff758b12b9aee573da82ba2e22b5279414fa54d5e7629f97e53970ab1f97a5

Download Submit
memory/2992-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2992-3013-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2992-9188-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads