7adc0031ae9fca8addc47c71270536b5d6a5af202f2e5beb1c5e1e9d72efbcf1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ef200489a7a4718bb5b5d6adfb33c9.exe
Size

348KB
MD5

00ef200489a7a4718bb5b5d6adfb33c9
SHA1

d3ed0308f61563ec8996b5d6e5506ea754aaeff6
SHA256

7adc0031ae9fca8addc47c71270536b5d6a5af202f2e5beb1c5e1e9d72efbcf1
SHA512

4c7e42de6895efcbfd3de08bbe3bc92a25897ea0c844993bb711b9dcbef9bdf5ad88723b59e3a3d416520e035ee3159ec799101cf2bff609020d10da2cca2b9b
SSDEEP

6144:HO+TyiE8+aqCjToXVpGOZcWixTmAcThAkZThMTMQ:JXEkqeolrix1c60y3

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ug.txt	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ie9props.propdesc	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado21.tlb	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\desktop.ini	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msdaps.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\ij	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\include\jawt.h	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ca.txt	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\zh-tw.txt	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\ConvertToJoin.wax	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\adcvbs.inc	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DissolveNoise.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties	00ef200489a7a4718bb5b5d6adfb33c9.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ko.txt	00ef200489a7a4718bb5b5d6adfb33c9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui	00ef200489a7a4718bb5b5d6adfb33c9.exe

C:\Users\Admin\AppData\Local\Temp\00ef200489a7a4718bb5b5d6adfb33c9.exe
"C:\Users\Admin\AppData\Local\Temp\00ef200489a7a4718bb5b5d6adfb33c9.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.9MB

MD5
87ae61344d9fbaf65f2ab6bf43740b11

SHA1
1398d71e595aca66f08a57cbaf96410d59f83202

SHA256
ae976dfddd9f8509a76d72ffc75b03043287528ce7b2973c0984232a365f6c58

SHA512
25f138bb69c3b462d9d9a70ded0662af9225c7423c8496d2e29c479a795ed353f4449161c7b58565c7e5c0bf6ff19c50469159f0e2313c853f2b9a13f134c69c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer

Filesize
5KB

MD5
6b99099c6a9b959f824e420676fe3dc8

SHA1
ba9e3b5f2f7f710d263272019be5bf5db33bf614

SHA256
34d5d8dc208ef8c73bb46fb3002fa22b8954d52a4e53be3c56b9801aeab56918

SHA512
dfe061ddec4106e68c8ea789009b0e6bf7d27072bebd0bdb724e4ccadd215b9122b04198bbc362753e2b35af16d993ddf89b44b29bb79c0e7a16eeb97f3b3d26

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-201-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-617-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads