Analysis
-
max time kernel
165s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 06:26
Behavioral task
behavioral1
Sample
110c296d95e2d2b9277a85d86b4bf5f9.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
110c296d95e2d2b9277a85d86b4bf5f9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
110c296d95e2d2b9277a85d86b4bf5f9.exe
-
Size
2.8MB
-
MD5
110c296d95e2d2b9277a85d86b4bf5f9
-
SHA1
f3150f5efac3ad6fce174575de02eb3a57fa8667
-
SHA256
d700aa747c0c6d4b6147bb798c197ff97212b917007998261ad919f974a339ba
-
SHA512
d53d7a9aabdbc8f2123681830a90fd0ec92c0c13c1ab87c142b4bd1f15940783caf29a75db235ef4b072d4395a91fd52ba4e50dfe6bf79b91f7b66b0dbef0cd4
-
SSDEEP
49152:1kYwgusNDS5lSGDtoZusNBk9/fw2BwfmM0fRD96:19jNDS5lShosNi9XwgwfoX6
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1428-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000300000001e7c9-6.dat upx behavioral2/memory/1428-61-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-92-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-98-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-104-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-110-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-173-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-229-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-305-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-411-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-497-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-583-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-644-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1428-660-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\dotnet\dotnet.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\7-Zip\7zG.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\7-Zip\7zFM.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 110c296d95e2d2b9277a85d86b4bf5f9.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 110c296d95e2d2b9277a85d86b4bf5f9.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD5aa9442d839f7fb0e22d0e44bbb9a0a90
SHA1336141c761684145988334b1b6a5a0927fd12810
SHA256d786d04685468a30bc5470bd2a71eb8b16b3c50d00784753c9c0ffdaf8ed2735
SHA512149d53f0ed625f41e91613cefa63c1934e2883559da47720bf49495d9713b00dc0047676145cb84c7148d50bfec9fff85e32687bede702e661a24c9f009f6d6b