682db59c6c73634521d262af78458fe845d798f73d184060f1f0cbce896dbeb9

Analysis

max time kernel
82s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba5fa224e7ad2bef0a925d0ca1113ca.exe
Size

10.7MB
MD5

0ba5fa224e7ad2bef0a925d0ca1113ca
SHA1

2a52c17f25bcd5c0050e9daf2e3f3687b3744fdb
SHA256

682db59c6c73634521d262af78458fe845d798f73d184060f1f0cbce896dbeb9
SHA512

097bbb6e0ec76fb127acbe064c4e2d7eb314e871b4cd1e58e849a52810e645cf3928ab9290442237929c3478c96f1c064d90b2917c1744e4b69e32a330ebd5ac
SSDEEP

98304:cd3334ysDOgiCkGyVPKAxOyLIlsX7KEUbYZfgs0Qlxd:cd3334R6J9OnwU64sN

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-928733405-3780110381-2966456290-1000\desktop.ini	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-928733405-3780110381-2966456290-1000\desktop.ini	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0ba5fa224e7ad2bef0a925d0ca1113ca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadomd.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\History.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\System\de-DE\wab32res.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ka.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msader15.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ba.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\System\ado\msadox.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\yo.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msado27.tlb	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\journal.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado25.tlb	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\bn.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fur.txt	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui	0ba5fa224e7ad2bef0a925d0ca1113ca.exe

C:\Users\Admin\AppData\Local\Temp\0ba5fa224e7ad2bef0a925d0ca1113ca.exe
"C:\Users\Admin\AppData\Local\Temp\0ba5fa224e7ad2bef0a925d0ca1113ca.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
34KB

MD5
3c4128607e70ca3dfdc5932ebd2f6e68

SHA1
dd00b4999e9cefe28dbbf997d1079afc10b23319

SHA256
7dcf2cdf53c8cd34af5c9494e501260f803af2141eb7107a1eea24929cb42bf0

SHA512
28d4713ab4302b11658beee0b8dac9ffbc3783c30d2c40c832103348edb7251f7aec79d07bd566cc3242a3ef376c33afeb52e3a312b2532636935a9948bf9f6f

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2184-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-49-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-97-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-99-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-204-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2184-234-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads