Analysis
-
max time kernel
165s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
010c62e22a37e742a7ea347a58c86366.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
010c62e22a37e742a7ea347a58c86366.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
010c62e22a37e742a7ea347a58c86366.exe
-
Size
3.9MB
-
MD5
010c62e22a37e742a7ea347a58c86366
-
SHA1
a2dd17da81fce6943e76f21989433c772bec7719
-
SHA256
530e4a75f9f5a2c7364e7cffa604baee0c023278bb1c90d4434f16cfc971531a
-
SHA512
caf26cd40e605ab8c0ac8fbf064f46282e0c38813e70a7161859141096ff225d490360d9490e788a38b2f9ae346d71029b0c47fb96019bf0b491589e64ea229d
-
SSDEEP
49152:m0MLfUkhbuRKwpB3UJuxtxujXabE+Qn/Jf4MgVrVjnTKAdf:m0eH0UJuxtxCaGyVPKAd
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\desktop.ini 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\desktop.ini 010c62e22a37e742a7ea347a58c86366.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\System\ado\msadox28.tlb 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Handles.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\ReachFramework.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\System\msadc\msadds.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.OpenSsl.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\mn.txt 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\ConvertToMove.bat 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Primitives.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsBase.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Internet Explorer\sqmapi.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\policytool.exe 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Reader.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Accessibility.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\pt-br.txt 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\msdasql.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\oledb32.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.CoreLib.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Asn1.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Loader.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationClientSideProviders.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationFramework.resources.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\System\msadc\msadce.dll 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui 010c62e22a37e742a7ea347a58c86366.exe File created \??\c:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 010c62e22a37e742a7ea347a58c86366.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4444 4972 WerFault.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\010c62e22a37e742a7ea347a58c86366.exe"C:\Users\Admin\AppData\Local\Temp\010c62e22a37e742a7ea347a58c86366.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 7042⤵
- Program crash
PID:4444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4972 -ip 49721⤵PID:2340
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD59fe7cc2fdca08504b3a245fecf47cb12
SHA107952e3719204687026d66e798bccea03084b3d1
SHA256002c0b6d1ec3bb37a7ddae49759d0ce64d70d5dd98746ac297c4ecb794ea9605
SHA5124366552f0c88e54b59110cd12061d8cbe6e813e4c2767a90a7ca047489134bf70bf9f35c0e1b668803529eacc1b74c4ac4a242f9b6e0c8c7da2c5333ced98b1c
-
Filesize
5B
MD5b5b682b742431a52ea8b17c72ad9c572
SHA1326320f469235708c59f678c9a7357dca552d306
SHA25630d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
SHA5124e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163