d3d3cc637380442979e047f76b5a57c90d06dd2f714bbb58b4d6393839447e39

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17d9519f8d50f03dc2550abc48bf2c2a.exe
Size

1.1MB
MD5

17d9519f8d50f03dc2550abc48bf2c2a
SHA1

b230d379034ac6cde7b9029363d9a6a0aebcf25c
SHA256

d3d3cc637380442979e047f76b5a57c90d06dd2f714bbb58b4d6393839447e39
SHA512

0b79bd9497117976e06d21ad3534da7cdf2a0f4b75eddc0f4017ceac2be2f4b28b94edd21a0dad7cf607457f57010804652e0ee7be08eebd7382f86acad73153
SSDEEP

24576:9U+1zmQr6EcDrVvplwwWvwROFCD0u0i/l2jtb3mu+ciFbwmEUJuxtxujXabZ:ZVZd4awWvwROFCD0u0i/l2jtb3mu+ciw

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	17d9519f8d50f03dc2550abc48bf2c2a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado28.tlb	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\OmdProject.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sq.txt	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\OmdProject.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\Parity.fx	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ms.txt	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\F12.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Internet Explorer\ielowutil.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Internet Explorer\ieproxy.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv	17d9519f8d50f03dc2550abc48bf2c2a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll	17d9519f8d50f03dc2550abc48bf2c2a.exe

C:\Users\Admin\AppData\Local\Temp\17d9519f8d50f03dc2550abc48bf2c2a.exe
"C:\Users\Admin\AppData\Local\Temp\17d9519f8d50f03dc2550abc48bf2c2a.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
179KB

MD5
4753f609c3552052653ea9b38bf35dc7

SHA1
a8465b3574cc475ca410a4aac85e7801559df353

SHA256
9e7e836c0d472ab33fb13d39f39f833cc1019f3f9025f1bf033048e34e416578

SHA512
d0f2af1ff2b907535f67a3c1d1f3962a5fb2d29713572c34f8867ba62b5c5bd2a1b7bc5cfaf7da9baaafad7d261d8885dff3dae37790f06117e6e5cf8538472b

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/2932-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2932-537-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads