a9fa357447186f9c23b5e5e97938f96d88ae892951b987af06e4a32fb0bbdfc9

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

025de082ba47b7ecadfc141cc7f234ac.exe
Size

5.3MB
MD5

025de082ba47b7ecadfc141cc7f234ac
SHA1

adff6ac5c86d0adc3e52ef13bab35a7dcb6edfe8
SHA256

a9fa357447186f9c23b5e5e97938f96d88ae892951b987af06e4a32fb0bbdfc9
SHA512

4aa2a1dbbe24098bb618b471ffa51ab397d6955cf778d6508367d0859ec989a58ff2dade5cf16ef66e7feedd08adb2c260677628a8898c58ed38cbab7b53e135
SSDEEP

49152:2lYvoGxUSJpXDd3334igWb2n8yIyiVPh74Gzqmf6aGgKqbvshL5lB6APyP9fnvG5:2sRXDd3334LXrwVegbk5yhLMj/H

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\desktop.ini	025de082ba47b7ecadfc141cc7f234ac.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msdaosp.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\hy.txt	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadds.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\rtstreamsource.ax	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\DVDMaker.exe	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nn.txt	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadrh15.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\adcjavas.inc	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui	025de082ba47b7ecadfc141cc7f234ac.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg	025de082ba47b7ecadfc141cc7f234ac.exe

C:\Users\Admin\AppData\Local\Temp\025de082ba47b7ecadfc141cc7f234ac.exe
"C:\Users\Admin\AppData\Local\Temp\025de082ba47b7ecadfc141cc7f234ac.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
2.4MB

MD5
da53794164b12dbb528f868398218e1e

SHA1
6aff17687f8550813a748670be08b50cefd811ef

SHA256
f09cba0b19ad8523694ebde843f2e7615536ad30cf4d7139b1473f35d12c34f8

SHA512
4b6f2af27c78a6a590f886352d7679d9ea3b376e0fbc71cf6cd40325c0e8ad1f75e7c75d1b6cc65218c470ce3039a1711e94bdbed6a3ea35a9176724d9ec8c26

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2232-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-138-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-205-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-206-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-237-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-243-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads