Analysis

  • max time kernel
    167s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 16:27

General

  • Target

    79456569b6aba9d00e641ce0067a0b18e4fe69232d6c356201d1ab62ebfe4c8f.exe

  • Size

    155KB

  • MD5

    82177e344fdd64c38e52f97120f60350

  • SHA1

    0566976b068f5260c6b3197764d289fad3ae99b4

  • SHA256

    79456569b6aba9d00e641ce0067a0b18e4fe69232d6c356201d1ab62ebfe4c8f

  • SHA512

    1a07735df00048c18c4f54e290bcb7e33ab98d15b8888e10aff1b03d10d2ba0d868b18b20c67dc24c69f5a3ea921b0f6a0d0b68d3052b5bbd3877fb0dbf7a926

  • SSDEEP

    3072:ejJ4RhNJbXOoGz7yxs0dqA0MAjfzihAMez:ejJ4DbDGz7yqpgRhCz

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79456569b6aba9d00e641ce0067a0b18e4fe69232d6c356201d1ab62ebfe4c8f.exe
    "C:\Users\Admin\AppData\Local\Temp\79456569b6aba9d00e641ce0067a0b18e4fe69232d6c356201d1ab62ebfe4c8f.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2932

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini

          Filesize

          2KB

          MD5

          075edfe549f4fd10a2dd7ff5de90482c

          SHA1

          4442bcffb6bcaa32f7e7ae8fff425601d09fbd46

          SHA256

          c19824f8b063c052175358a574c417099c4d18fb89e85eabe9820eae35ad3075

          SHA512

          af288e922ef8179dbf2d35f56cc97b75827dcaaa72df58ec964c5e69d19072e4e02824e2fa9c5c1b7d0cebe970eee59fa8cb0b19ced96678d86ca966aa663f06

        • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\README_FOR_2373713F-F24F-42A1-A626-C634DE2D85CD.txt

          Filesize

          1KB

          MD5

          67380e22c6e7a7d5d8e0369146626406

          SHA1

          7171387949b9c89b913ae4c33094e1c18fc2a3e0

          SHA256

          30d2afcad6d94795ab51964df0ff34ab775759e9984db376d541479fde5b62b2

          SHA512

          20b21e755ee4a3fbf552458d5c29c762ead959eaef721b48cbfdf2b83893c815e7941ad6b6a6a4cb58e85bd772c24eeaa7274a156211506bb39b4eb9cff3725b

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

          Filesize

          2KB

          MD5

          64c0203f1a4af033be9bd8bc0a7b234c

          SHA1

          6986cdda2474e0d8c4aa5339a95ce4fbf1382950

          SHA256

          ca56b677fb154ab3283dd496cb8a017e832115124221c1293fde8d9cd5823d35

          SHA512

          b1367daa5195b1dc8263d6994258f6031eb17211757273991fdc47e1fb45fec6a080e209f113d64a0f831806099c575e2a1338508c803d691ad05a5284ae8d41

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

          Filesize

          2KB

          MD5

          eacbcc712bd10bf0aeab063eb0b8d30d

          SHA1

          000fe6dd8746de82552f7383ca07f3069e6c7059

          SHA256

          e195cd76e7fbb61a3388961369e5848262b7c4b7b5b37731c1ea27fcdb36ab36

          SHA512

          a184079f39fa59bee3193d3b8c8fe80be7596dd31cbb74db690cf0b915150c31cdc0a8b3b2a89c2280e288123ab21a3356da35478404899269463001f65385a4

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

          Filesize

          2KB

          MD5

          f7386478541768a7b7cbc411cc46bb2c

          SHA1

          20c6e031947f356586ced82ac334e7be962a7946

          SHA256

          dca51069da5642f46dbf6dc5220295ced23c63b2b4cc7044d91226425070c7a5

          SHA512

          1b14966ab76983c24e100c99b312a43277af8d5e6778caac665d07f3cdd324044bf1782830f4b65b5651e641a006900232c4f6aa37b94ca77b5ba2826e3a0758

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

          Filesize

          2KB

          MD5

          277ccab32a1766ab7aeb1a638c4606dc

          SHA1

          0041c0bb31f702053c2b858ff55b74917b125a1e

          SHA256

          19a9871df7788788e4928bf19553c491d85d21d001643986ff0b5c0de0e13824

          SHA512

          5e158c198dcb1a2c5b8499d9c53c8292c7c3b2f79bf8fad707fc7d39c748b2f7231acae34730c7c097bf177cb7311c9dd80abd4e85f07b7ab4a8346726fcd413

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

          Filesize

          2KB

          MD5

          1fc940acba77b90b644d1d8631419dcb

          SHA1

          abf8d5759bf667d31d2e26880a6567258c46dcdf

          SHA256

          5f9b059b637c5080e84abb5566992d763d9df39689b1de8aa1a8f4cf34f9bc23

          SHA512

          d14dcc87b98e6487e76cf838558f45743d7454d176bb5d9392c733cd1952225e0c1c26c95302b6ab0a60e50fdd0616a66382dee13a6296d3a84bf0eecc8c1129

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

          Filesize

          14KB

          MD5

          afeb423f279167c1fb99645024944a02

          SHA1

          90571b178e41953c5109f3b9bab033cd6947a74a

          SHA256

          f7943ebadd8f83029972c25a367e184b91e7721313ffb6ff3ec3a7ccb990371a

          SHA512

          13a59f8683cf420f67188adf1c8908200bd3cfadeb1058f37f6704a1f1db7c7f4293e0d0ecd1b9e31fd1be1228d39b9f42240e88db6ab5579af9b81d2dba897b

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

          Filesize

          11KB

          MD5

          713062f97eedbb61e8cf9b8725081e33

          SHA1

          d018e1e325f679ae7ce3d37a4990f325161a0635

          SHA256

          918d57d09c900c36ae7e53d1a7dfd9961d8a431da7c54811d6a44644d393c041

          SHA512

          fba16c896681bfb8bdbd18cf21e726e9d14b64990dfa7db45f21a92a85cf2ffbcf440827fb559f1c33d2121f920109070c982d01dafbbb37d6349bdcb2209f06

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

          Filesize

          2KB

          MD5

          518712ee9972dd92249ce1a4e8c4df53

          SHA1

          808d4003b0f0748f93f50c34394cfdecfcc5f193

          SHA256

          83fac647f06a0c2f9638b2ceb86ae085bbc785eebb058b039d940eb30e42e6f1

          SHA512

          c009e47ae02a1490af631100931183a3c9bdc58d036d2d921aacf714ec517475ca5db90a527ca7c259d1be9341132a47b54dbf2e2a0d2f7952dd9e2c2eb52b85

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

          Filesize

          13KB

          MD5

          92cf002fa6bd2b0660fd9c88d6bc6b04

          SHA1

          7ecdc73dee4e649fa91ffe0ae8bd4e8ed69a9825

          SHA256

          b6866105f0b16ba2df95526889f4503843084f0807cc9778b780a9bd5d441d00

          SHA512

          d80cdf28bbb034f2476b4b871c76592bdfe34329cb3f338bd69704688f6248cb10cdcf59c196974cde3f1b90aa941b5e74b6196c6374daac65e8e4c4c9b86fc4

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

          Filesize

          9KB

          MD5

          8574275c96a65e5e69e929133463fb83

          SHA1

          a69f9850bb342ec28966c1895c697acd5d0e7c0b

          SHA256

          3ed30ca60f7ae1d258de5069c99650f00a32c032edf54b36d633f193c4c8e66c

          SHA512

          e19b756ad7c9b7ad42cabf33b0710418802643f36dee88ccfb06ca6dc01b43c44409b764920a204d1d2dcf198e87a92c4d7670c8b0487503dd089c3387e43613

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

          Filesize

          9KB

          MD5

          6368ae02fe9b2bfe4244935bedd44dfc

          SHA1

          cc28ad5fb6f3a3f68214ee2a9b9529f2d4f4cf44

          SHA256

          4bfd45311c4c8bad6ad48a2a26afc992d2152f2812b095a85b53caa3b07505ec

          SHA512

          a5a7248901dccf1da72f1b24161c12dcc9c3bbf4355144cfe0e2243d2ea270c88f5618e4c043972daff2b238208c3bdc00bc030cba2b8646c34712fb3849b971

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

          Filesize

          2KB

          MD5

          016781e398829bd95a2143a4589354ba

          SHA1

          6eac3321ab4a945dd900b1b9f7144fe0137629d4

          SHA256

          f33f2bf2a85aa8ce0bb1292db3261bfb0bd9df5552bf7cefa48455b53fc035f1

          SHA512

          e59ff93a47a58ad8110f43054286ea8291ac894e150dccc55ed39f4248abbb332a4439d6dcec2bba5aa6be719496b6fb8a362cacc22b068bc9af2b14bb62d1c9

        • C:\Program Files\Java\jre7\COPYRIGHT

          Filesize

          5KB

          MD5

          7cdbf7846ec4e2a5216c0e889c6ba2dd

          SHA1

          2130329a92f37bee51db1868f2b109589895efab

          SHA256

          82bb69ed73f602567341b0890dd250342f41c947d6ccc5482d64177127c6dfc4

          SHA512

          4c1947b2f48474ede65bc0394eafc0a2092ae14877eb9ab0882ef787ccf3694ac1099230d9582dca4fbc11cf4444600e797c0d0a5e1cca268215325dd564d130

        • C:\Program Files\Java\jre7\LICENSE

          Filesize

          2KB

          MD5

          0c34734a96f895cc89128a11c6495c79

          SHA1

          6372f3e98c0091aeadc9a3477579062d14bf7e03

          SHA256

          0f5ddc6ade516ed5662d26adad500ef948fb13cf074e008e0cc3fa3e0a92ac70

          SHA512

          7c92a4ced443252c85d9446a4280b4a9b2bc6bb2c1c78d323a0572c02a6791d15eb8432ad6d61c67e688f15531633f65275ee45d02b178c709b2c326897f587e

        • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

          Filesize

          111KB

          MD5

          fa32c02891425508569b058eff0f87ab

          SHA1

          245136296b5eda05ff4716af4f76d4378a4f1c5f

          SHA256

          57f0924f71659b23a65156653e8f15f872644290c36d8c5979a8b5bb4480dfe0

          SHA512

          176dafd50c2e613d666791666f14f217427a624cf2d4f526e17999d5af013a6fa583066861d7eb5036a474af7636b315dd1e798839098d5843ead993f9411544

        • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

          Filesize

          175KB

          MD5

          7e1bd05681be9258b8ff7635f5c366de

          SHA1

          5001ce21c13c0f07e960381d3f9d572c0da86f97

          SHA256

          85b4673e5a83b3bc4030d40a73ca1918444219a395dd928f69c21549251e9089

          SHA512

          33c7483ef25a851c759d2cb515d5a43c55819e5b1687a1dbbbb46b500963b31444092738cb951453afecf15c53b14a155891c4fee561ecc3799053452a83af18

        • C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties

          Filesize

          5KB

          MD5

          359f6a07ba24e8a96aec40b29dc6b74f

          SHA1

          7c17df6e6f6df33a31f64ddbb69a150c34141a4a

          SHA256

          d2accea22d28f1acaa0540d024b27a7796ef97f50720d5a5ceac02b9e4e8352b

          SHA512

          115dfc39d9fc3876e8049ac85e44ddb40edf312f19daffea22ff56e5631ddd2f3276a04782c7042d6b903b92a093db327b910be9fa0236f5bb82ab393db7fc2d

        • C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia

          Filesize

          2KB

          MD5

          c9299cdab347bbd048acb89b830f230b

          SHA1

          95dfe8ad78979f6ff7d8d7b511daa2913b3baa0a

          SHA256

          f6668659daaac3d463eb07867e3f29df41039337711457a5fced366cf1d4c6a6

          SHA512

          f467da8877b60567d3c452a1741799324d1aa040a5ea864db60fadba340098961d1e6f356e902fab340265ecf7110629e30d82f67cfa2f1e7bbe52b57c35ee2d

        • C:\Program Files\Java\jre7\lib\zi\CET

          Filesize

          3KB

          MD5

          dd83ba0a27ffa24145e4526f0c9fdb70

          SHA1

          dd43345e74aabfce4f3bfd7b2ab8e0506383c1de

          SHA256

          28c059b1f4fa02a69231deafbb96967d4e038230b12af165f682e0a8b9b92b4d

          SHA512

          9ad8ebd6fecedf299b950210aa1c3bb53354af570fc298416dfdeb60417be54837f0403ff0a20542d57ef6680c9d2f22f3afe600e40075c6a4111b686571b279

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4

          Filesize

          2KB

          MD5

          529cf1d828da8e7f1d82add784ea48be

          SHA1

          1655f592183d262d4bb3657fa8d02c3bdcc7062a

          SHA256

          33023d97cea1b42d3e144f2b52eadf7e28fc033b59c2bd4c4526ef2baee94b53

          SHA512

          fde7bfc38c55db87b453cb832614b88e16f48a3ba64b02716f516b51afc80322049d90065d3c8d2eff25edf28f12976b8f80d24a0109b517dbb7588488a9988d

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6

          Filesize

          2KB

          MD5

          9772d1e4b320db4f2c311c141105dcac

          SHA1

          9212de14c1d751aecaf444c98c824bced50623c1

          SHA256

          9ed17605bb78c62689590bbc5fa80718940fa4fe0a374eb319c26dac0e82538b

          SHA512

          d61a20112ee9f84d571051dc0019b336893d208e01a2ea1a89d8d37c2f913848b242670a473626786b086223ccc1616e46ac9ab8c730ea69ed8d5e8675ebf0d2

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8

          Filesize

          2KB

          MD5

          cf3df84f42ffc20b309ea94de74bd1cc

          SHA1

          b1f26b92740c9206d2e28ab1e3a268596ad29688

          SHA256

          39106c09da0dd1e79e1a5a728d5ba9e349b116d0cb2cbe1f689d7f64611f8c56

          SHA512

          557e8b1da128e7f9732c20f4a7847020424f09fd4caef993e6bef9c5102935fe87bca37513cd790e2ff472edbff937f798c988d677e170a874eec4fb097a8c47

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9

          Filesize

          2KB

          MD5

          db3720411d77fa16afe97004f857cae0

          SHA1

          3f402314b3283c07a26e52bd5b7ae59899512304

          SHA256

          ddd9801f781ecd30ebafca60d9e4eb22d6c82265497505f9e14477e982d63298

          SHA512

          ec44817aef048e7d5154e7f7aef38dfaf32e249e49d3cd27f991acc352d466cb3aa1555904fb1b8b791f2256d89e64da3e62711a46f624d8d71d0b2a20ec9583

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10

          Filesize

          2KB

          MD5

          24fc04e5fa45cfa69d938c4234f3a17f

          SHA1

          885b9a5bffe8f963a7a3c8c1fc8f38d852371426

          SHA256

          31b0ef3f52438e6c02d2c9336ea9a506c605c0fa2b371114b8e34c4071ab6190

          SHA512

          7107a192cf133ca6c29a2baefab566a726aa32d1e27a522c2f04cf210cc1f269c64bb33587e5a564dfab095b404c8602787e57f24bcb91f138a2ca513af0d7ae

        • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7

          Filesize

          2KB

          MD5

          7e019f784cf06b51deb25902b8da208c

          SHA1

          df582a2c04fa289326a30fb1242690e0d0a42ba2

          SHA256

          72ea7ef90ae2f960c437c5527e75134d1db341d73bed75c35b24e69648c1257c

          SHA512

          87041f6e25b72102885a9b259dfc875da52c98c183a7a899895640ebe5bb140e08a987adc62e8e83b9a40847a811a917783e55001f7d1e19f24a1b62ea319e65

        • C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

          Filesize

          609KB

          MD5

          999ffab32f23450a50dd430148332ffd

          SHA1

          53be3ae3130bd22ec69fd8c04db116b46ace7373

          SHA256

          defe5f70f5aa8c7e18d1b5bd651a7da9a560fd4a72630f613a602a728e09d83d

          SHA512

          434547f62030f89baec38362d5e7e7d523ba850012007a1d753fcfc570a0dcbec7964b5ae90cca2d4e995feb310a1217db8179180fd4d7942a274f67db91de89

        • C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

          Filesize

          786KB

          MD5

          58a43e4e2d66b796af9871bd99b9a90b

          SHA1

          5fae453d30b43b95ee33a3408b15875546035c51

          SHA256

          4328bc561ea7aec63f6121747113975fd9c1942b3729988dd17e14c819ee9934

          SHA512

          8ee63edd557c7da9b9de3829f27041696871c16f41074b89072d69ec17530e2e5f92720f1497ef314ad7728218d245ddda64386f3071d8da7eea9e220789cbad

        • memory/2932-502-0x0000000000080000-0x0000000000088000-memory.dmp

          Filesize

          32KB

        • memory/2932-0-0x0000000000080000-0x0000000000088000-memory.dmp

          Filesize

          32KB

        • memory/2932-7-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB