Analysis
-
max time kernel
19s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:19
Behavioral task
behavioral1
Sample
11f53ca6266c7f39e39ff13e90bf5440.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
11f53ca6266c7f39e39ff13e90bf5440.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
11f53ca6266c7f39e39ff13e90bf5440.exe
-
Size
2.8MB
-
MD5
11f53ca6266c7f39e39ff13e90bf5440
-
SHA1
60e224d7b695c767bf7451cc3b24d7d02797c601
-
SHA256
08761303c60736fd17b3088775a6b5b1e46c1803358afb7440276b024ded6b24
-
SHA512
dc3f937c1f7d00007a3587ce8b0187b83de00c389af7c69b622878348bcb25ec4fa308187e91b01a58f2ddd16bc52edd78cd244f0aaa3e885f5469287c314692
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91s:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0n4
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1744-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x0034000000016ce2-5.dat upx behavioral1/memory/1744-557-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 11f53ca6266c7f39e39ff13e90bf5440.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\ja.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\tg.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\7-zip.dll.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\7z.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\fur.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Pipeline.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\nb.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\kk.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\ky.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\tt.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\descript.ion.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\7-Zip\Lang\mn.txt.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.exe 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 11f53ca6266c7f39e39ff13e90bf5440.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll 11f53ca6266c7f39e39ff13e90bf5440.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 11f53ca6266c7f39e39ff13e90bf5440.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD519f1b3f70f7f7e0d35d2056591e82c62
SHA119e15cbca51803a61ded60c44696181030ac9082
SHA2567de26ec71dca5646277cc7632829dce24bd2a89c7071cf1437c176caf72419a4
SHA51284d407495ad368a0d13a5fb5f27a558dc26c136465837d14a7d4b91fedf14e564b9dbb37c63bdfe35caab2a333da7f8ada92ac1993c9e65cfc736729a7627c03