96111da62ea9dcaad227cfda1a84aec12f166b4b7ecb113028ef1039a9bdbc24

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21cd307a141add1cdbd88b6e9f5361c3.exe
Size

2.8MB
MD5

21cd307a141add1cdbd88b6e9f5361c3
SHA1

8f1dd80d353f495803addcbab823e602cf3e74a6
SHA256

96111da62ea9dcaad227cfda1a84aec12f166b4b7ecb113028ef1039a9bdbc24
SHA512

bc69192429c66db5cb9d49fdd4008e155c76bf5f04eb698406714f047c0804944185362e08802261caf8374ca3e07c7f86d7d52f64bfab03493bc144ebe65d38
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91M:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nw

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0022000000014e4c-5.dat	upx
behavioral1/memory/2264-2111-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2264-8167-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\desktop.ini	21cd307a141add1cdbd88b6e9f5361c3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\PST8PDT	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management-agent.jar	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.exe	21cd307a141add1cdbd88b6e9f5361c3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll	21cd307a141add1cdbd88b6e9f5361c3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.exe	21cd307a141add1cdbd88b6e9f5361c3.exe

C:\Users\Admin\AppData\Local\Temp\21cd307a141add1cdbd88b6e9f5361c3.exe
"C:\Users\Admin\AppData\Local\Temp\21cd307a141add1cdbd88b6e9f5361c3.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
2.8MB

MD5
f78a0e6c98ead2e6497010cbe1ca0d19

SHA1
3f832db191f3cbfb5f647f690aaba2b6f9ef1000

SHA256
3abbe198d8a3cecbc098415da672e571e66ac2a0535a332c89822ca029346edd

SHA512
f14abd482177d96f0ed390460d0996f94707e98b2cc61b7bfa79fd582f6ecd158ec8978131aada5f7a49daa4d95d8cebccea1f49579fa9f52a78d29a5b66e955

Download Submit
memory/2264-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2264-2111-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2264-8167-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads