d28b6c5440650449f28979e1102cc0dd511a18f75958ecf01f64db4b8ec7ec10

Analysis

max time kernel
119s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1067069929419a83beeab2e59c0f42f7.exe
Size

4.9MB
MD5

1067069929419a83beeab2e59c0f42f7
SHA1

3edf798e6401df4b78df6b3f2a592cc62af880a9
SHA256

d28b6c5440650449f28979e1102cc0dd511a18f75958ecf01f64db4b8ec7ec10
SHA512

6424e797ee917f4ead4d5497d7fd64a520550097c83fdd31fc0f3031d32e8ae7a92be881d5bf51587a35e2ccdaa867ea008aa46d036382f442ec4ad93f2fc3ef
SSDEEP

98304:2/Vd3334TUJuxtxCabTmXrwVegjfk4pCLNCOEZ:EVd3334NTIrY1Eg

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\desktop.ini	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\desktop.ini	1067069929419a83beeab2e59c0f42f7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\Microsoft.VisualBasic.Forms.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Xaml.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.SystemEvents.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Xaml.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\hy.txt	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Console.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceProcess.dll	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\TipRes.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\System\msadc\msadce.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\kaa.txt	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.AeroLite.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Extensions.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcer.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationCore.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Queryable.dll	1067069929419a83beeab2e59c0f42f7.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Luna.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.DirectoryServices.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\Microsoft.VisualBasic.Forms.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\adojavas.inc	1067069929419a83beeab2e59c0f42f7.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Buffers.dll	1067069929419a83beeab2e59c0f42f7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1872	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\1067069929419a83beeab2e59c0f42f7.exe
"C:\Users\Admin\AppData\Local\Temp\1067069929419a83beeab2e59c0f42f7.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 524
  2⤵
  - Program crash
  PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1872 -ip 1872
1⤵
PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
3.1MB

MD5
be4eaa910ce16d02557439b3885d82cc

SHA1
002cd145448353c08e788e4fa9c13adea55fe37f

SHA256
15f8cbfa505c729f62c17d941677ecc5da6c50c0e181ea809c8b82327954679e

SHA512
755dcf85f614c93f56be0c9bc82720d544015213c5cf90524b0eaf8d39f1afaaf807ca6944e8d817e4b3d584186da6ccfb5fbda2242af7bbca4c53bafd927949

Download Submit
C:\Program Files\DenyReceive.eps

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/1872-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1872-1411-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads