8f97ea0514a368fd099715fb2bffc7d7480530a03631b78762e5e8f9b8a1e6f5

Analysis

max time kernel
162s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0026eb355cd9b90a546bd29c110913f1.exe
Size

4.9MB
MD5

0026eb355cd9b90a546bd29c110913f1
SHA1

61744e7088086f0bb1faed13f1be176970a8a042
SHA256

8f97ea0514a368fd099715fb2bffc7d7480530a03631b78762e5e8f9b8a1e6f5
SHA512

02d462bc1de595ce2c1dd2b15fca745678e2c3fc98f18c7e4098a8da6307c4d84bbb262ac1ae11e88a2001ec81646bae460f8b5f6479000a8321315a2394e8d3
SSDEEP

49152:IYDYoyyYDYmYgGd3334IOdYrpJgWb2n8yIyiVPh74Gzqmf6aGgKq9+Qn/Jf4MgVl:JMoyckGd3334tKYXrwVegzyVPKAd

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\desktop.ini	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\desktop.ini	0026eb355cd9b90a546bd29c110913f1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.OpenSsl.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ps.txt	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\WindowsBase.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationProvider.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Windows.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Design.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VGX\VGX.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Design.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsBase.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.CSharp.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Extensions.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Numerics.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.SystemEvents.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsBase.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	0026eb355cd9b90a546bd29c110913f1.exe
File created	\??\c:\Program Files\Common Files\System\ado\msador15.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\es.txt	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Threading.AccessControl.dll	0026eb355cd9b90a546bd29c110913f1.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll	0026eb355cd9b90a546bd29c110913f1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4944	4984	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\0026eb355cd9b90a546bd29c110913f1.exe
"C:\Users\Admin\AppData\Local\Temp\0026eb355cd9b90a546bd29c110913f1.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 796
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4984 -ip 4984
1⤵
PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
5.0MB

MD5
5c4f7c69c3470a8988ea97cce11a961d

SHA1
d2e21cb0ba83aabcd8caccc391763b3edca7a293

SHA256
8460c3930729aa976993cc4ace741ffb6d21389f3167bd991a24c532d604ef10

SHA512
4f6c637f15d0450dec77ab1e47fb2d60dc03461347c37d058066358715fb93e65bddd0cdaa14e6d31ea34773eca82830b757c968ea748e3f785589d64a489f4d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/4984-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-212-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-149-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-182-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-208-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-211-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-228-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-229-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-927-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-1321-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4984-1418-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads