7ef81995f0a598fcbe79a26e07ab87dcb977fb32ac2dc89f9d7b602a4bbea4f8

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ba74c51f58f730f96c51041d5779b54.exe
Size

1.8MB
MD5

1ba74c51f58f730f96c51041d5779b54
SHA1

557256024b5c2cf9ecbb24d357edb265eebb3681
SHA256

7ef81995f0a598fcbe79a26e07ab87dcb977fb32ac2dc89f9d7b602a4bbea4f8
SHA512

690af2054835954af5e02f49b086939a7435c67d9e9fe3f4bae2ad4f014ff1ebe781706fe8ede38c31e073e99338a638449380c1e946e5c71b050600eaef3762
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqH:SCqm2Jpr0nNM7Dus7Nxi

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1532-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022849-5.dat	upx
behavioral2/memory/1532-778-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2native.dll	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.exe	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat	1ba74c51f58f730f96c51041d5779b54.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.exe	1ba74c51f58f730f96c51041d5779b54.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	1ba74c51f58f730f96c51041d5779b54.exe

C:\Users\Admin\AppData\Local\Temp\1ba74c51f58f730f96c51041d5779b54.exe
"C:\Users\Admin\AppData\Local\Temp\1ba74c51f58f730f96c51041d5779b54.exe"
1⤵
- Drops file in Program Files directory
PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1024KB

MD5
6f3c31a880db3e9e35945c17aaae34d8

SHA1
cf09444cc59521ad1cca8632581dcad9977d96a8

SHA256
1cbdb1a76150f6b3bd910bd6e17a5dbd40ef31427d64e87231b5e4ea73dffafb

SHA512
db07930d9ff7688e01ec30b3849c24d60245b8fe68f6b40d7fa9d2629a72e86fe4d862c28a5840815af6373cdc1fbacc7202e62a91aa35da73582b324aca6e4d

Download Submit
memory/1532-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1532-778-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads