2986c7e6139464132dc0b843aaf4a73aad37c2fb14df59ff3d6b27e5576bdaa1

Analysis

max time kernel
161s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

131e432be2ecd2f10e63442a92aaabfa.exe
Size

1.8MB
MD5

131e432be2ecd2f10e63442a92aaabfa
SHA1

210785d577be66e8e7ff96b6036b4dfd3f8dab0e
SHA256

2986c7e6139464132dc0b843aaf4a73aad37c2fb14df59ff3d6b27e5576bdaa1
SHA512

d054c899df65bc69a363f88e7d6dbf23d97d5920ca76c17b5bfff42918713c71b831fdd5407ad38083c2fcc928738085ba02f535229203cf475142e3c234f38c
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqz:SCqm2Jpr0nNM7Dus7NxC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3172-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022910-5.dat	upx
behavioral2/memory/3172-327-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.exe	131e432be2ecd2f10e63442a92aaabfa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp	131e432be2ecd2f10e63442a92aaabfa.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.exe	131e432be2ecd2f10e63442a92aaabfa.exe

C:\Users\Admin\AppData\Local\Temp\131e432be2ecd2f10e63442a92aaabfa.exe
"C:\Users\Admin\AppData\Local\Temp\131e432be2ecd2f10e63442a92aaabfa.exe"
1⤵
- Drops file in Program Files directory
PID:3172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
6858055c0f10838ff7704f45b17e4073

SHA1
e85762f861269e7c99cefe71efae34af6e7ed5c0

SHA256
7025b6d78fb7dbf0ef00aae790dd06dbf67397c78c7545bf449d25440cd364f8

SHA512
543c45bfe71db2f172493fbf575a56eec9ba25ce83ca589cf19c227a70253f7786a5afc76a7e3d0b1920c881d7d8dc2066d7cc027c0473f1e1d83e3308f3daab

Download Submit
memory/3172-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3172-327-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads