899f922e4b270004fa00b8fa2310a7a161aadb076226acf0968bb83e2fdfac10

Analysis

max time kernel
101s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10c12793170fadd6765f881228186bd5.exe
Size

1.8MB
MD5

10c12793170fadd6765f881228186bd5
SHA1

090f7ce12136b6d388ca36a9e531958654e0c6f6
SHA256

899f922e4b270004fa00b8fa2310a7a161aadb076226acf0968bb83e2fdfac10
SHA512

3cd4980214c6cce4dcd82e8fef94293d467cbf49353d3e640fa50b5b8d94a830b582a6c47178c136cfb82108e8cec47f8062eb6afff0ed4dfb94d40295bfdda3
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHv:SCqm2Jpr0nNM7Dus7Nx2P

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2160-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022849-5.dat	upx
behavioral2/memory/2160-25-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mng2.txt.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\CheckpointSelect.vssm	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.exe	10c12793170fadd6765f881228186bd5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.exe	10c12793170fadd6765f881228186bd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	10c12793170fadd6765f881228186bd5.exe

C:\Users\Admin\AppData\Local\Temp\10c12793170fadd6765f881228186bd5.exe
"C:\Users\Admin\AppData\Local\Temp\10c12793170fadd6765f881228186bd5.exe"
1⤵
- Drops file in Program Files directory
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
91KB

MD5
ba86d229062b508ddbea7edd48667201

SHA1
d052187a0c54f08e5c174311ba0e3ef46e7568ce

SHA256
ee73230f8ebc13afd004858e88e217a971ce6c66ae86b128a2bda596f4535b38

SHA512
e97d2a14753a6affcfa0f66c447f95d51c299edb62174017fe6994692770fd050f7a19c7405c778d72fd40effd525cd9318e7e8165f5a706000013e1ba24aa02

Download Submit
memory/2160-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2160-25-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads