Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 12:25
Behavioral task
behavioral1
Sample
1871249e4c40b8cf4ec8c7d2773947be.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1871249e4c40b8cf4ec8c7d2773947be.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1871249e4c40b8cf4ec8c7d2773947be.exe
-
Size
1.8MB
-
MD5
1871249e4c40b8cf4ec8c7d2773947be
-
SHA1
75df2c56602b0102e659e7c9ca4fd88eff1b5861
-
SHA256
c5df814db402f33627b529704a8d6ac0954f0b1ff56f2f04cbac40edecb704d2
-
SHA512
a189b89dbe071dd63e25978fccf031e2d2d818555edce6cb6063ac458cd369a04913a832fd05054cac4b332c515f455aacf658f2e1d1efb9bd8f4c62ee4b13e5
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqx:SCqm2Jpr0nNM7Dus7Nxs
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1956-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022791-5.dat upx behavioral2/memory/1956-218-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\7-Zip\readme.txt 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\yo.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\bg.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\pt.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\ro.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\mk.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\7-zip32.dll.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File opened for modification C:\Program Files\DisconnectReset.cab 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\7-Zip\Lang\kab.txt.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.exe 1871249e4c40b8cf4ec8c7d2773947be.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.exe 1871249e4c40b8cf4ec8c7d2773947be.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5d88c6abb1b4bed08534fd69607c97915
SHA18f3f6f59fe64e5cd1bc711c2974d3fdb70d52c3f
SHA2569b8a570eaee7c4e5813da2a136ac52aac54f1826404b7395d40c8d5a86c500c6
SHA51271997b2622e4fb8a221c328091f446625d417714fbcf17c24f55995eb906f22b052b9e04297118bec19fedbebf09717c38385d0f45bab42955dd664a1e189c41