Analysis
-
max time kernel
6s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:13
Behavioral task
behavioral1
Sample
1f9f56eaf4b01aac1e330754ffa3709c.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f9f56eaf4b01aac1e330754ffa3709c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1f9f56eaf4b01aac1e330754ffa3709c.exe
-
Size
1.8MB
-
MD5
1f9f56eaf4b01aac1e330754ffa3709c
-
SHA1
c83b04de3a15b8ef49570a964f48a9375f9e3fb8
-
SHA256
96aa19d866c2241cef36d6c0fd8e8526c608ff11e20e1aa1fed21a442d93538e
-
SHA512
cf42bc25b1e3bd7416da9a28d02a60081bc79e2b903ac2f99eff3e696e330c81dd8dec9d1cec5cc650246f6d01a6782c7d39d2940d222eee98814376262398a9
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH4:SCqm2Jpr0nNM7Dus7Nx2Y
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1048-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00010000000228b1-5.dat upx behavioral2/memory/1048-3599-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/1048-13391-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\Lang\ar.txt.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\Lang\af.txt.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\Lang\el.txt.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\readme.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\7z.sfx.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.exe 1f9f56eaf4b01aac1e330754ffa3709c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5005ec2967f0ece43999f4c37a6ae5ce1
SHA16aa011948e79020714b8f7fb0d6dd74e2a78355f
SHA2569cc5615210e03bdfa39980f7e66c90bc371309c862ddf086126d56aa90727415
SHA512bcff4d02585e278748a871feb62e3dbc7d4c14f3123dbbf45813100796d2fa5f9c7ea82b787ad16aab077cf08167cbfb9aa2d303a3c8519ed9d5b04a37444cc7