68f0796fa698c6923791e0fa2b9b72ff74a8cc14c4f727614cb271d548878789

Analysis

max time kernel
5s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22994538bac717f0ed3783e582b4f67c.exe
Size

1.8MB
MD5

22994538bac717f0ed3783e582b4f67c
SHA1

68f0d2a20bf53730b323b7972d509f57275c8655
SHA256

68f0796fa698c6923791e0fa2b9b72ff74a8cc14c4f727614cb271d548878789
SHA512

f086d5cbb11cc63dd6a35f19ae48d20a7af7c0f97d0d97d1708ea18abdbb7d172ef5cc2e87f47f323bb040741c501abcc5fd5b844c4db8e99580c5364d7a9f28
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqtAZ:SCqm2Jpr0nNM7Dus7NxBZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2192-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/2192-4804-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000021e1b-8616.dat	upx
behavioral2/files/0x0001000000021e1b-8615.dat	upx
behavioral2/files/0x0001000000021e1b-8614.dat	upx
behavioral2/files/0x0001000000021974-8640.dat	upx
behavioral2/files/0x0001000000021974-8639.dat	upx
behavioral2/memory/2192-13436-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\7-zip.chm.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\7z.dll.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\descript.ion.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.exe	22994538bac717f0ed3783e582b4f67c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	22994538bac717f0ed3783e582b4f67c.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.exe	22994538bac717f0ed3783e582b4f67c.exe

C:\Users\Admin\AppData\Local\Temp\22994538bac717f0ed3783e582b4f67c.exe
"C:\Users\Admin\AppData\Local\Temp\22994538bac717f0ed3783e582b4f67c.exe"
1⤵
- Drops file in Program Files directory
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
98KB

MD5
243a48f0aca74b1dbcab7281d4c36100

SHA1
90002c88bf31d92438239324393486cb582a9131

SHA256
1fdc986f8c2c61715646b9e813412a2dfe3e06b9a1af495b6169e8d02387d5da

SHA512
14f5979b99e2f1ed1060566a875a6d516caec15df4584e3e0b17d218d043d09f99e99ae56481aaa1f8599eb83bcebfe1c23d158a9cd050944ef857c735aa9c65

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
93KB

MD5
bfc8d6625a3f87155f8c049e04b2ea82

SHA1
50ba8fc18dd33697a2d33ded925903140df87a6c

SHA256
08050be4c72ae4b6bc75da4a9c68d1bdd4dcc7c6f500b85b2d70d1350fb93f3b

SHA512
72856e025e5ca2670be1d0f11ce210ef3f0f60af92c9e11d9312b7fd2e0148e76ea4b865a2579219e3820bb43f1649000f26485685ceb7d3ac76a427b3052e23

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
382KB

MD5
ef93aa14cf71e8c2b47b3c8422af3ffc

SHA1
d18b8ea4d42c1136cb0960a333afe8834979470f

SHA256
f58fc49f3733f7550f37373ee0bb62e24d1d7e67e682d71d296654e297481b80

SHA512
0df1617b0483ac76a78baa32420b5a5f793fa6c00ac1079fce4c24c8ab66c87aad0a422c9a9cd1935c311e7f0cefd552dc5e9e81e0b27a6b056aeb644c166220

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
92KB

MD5
94d0a59e3e1f8034cf928876b525b2e7

SHA1
30600a6adaa67b9869a92bdcd1fa14b38632e150

SHA256
ed4e1966cd563d7725bc4d87fc6c03e4f2c170a015dc364b4ab9dbe923de852c

SHA512
42d76e865408a314eac1a5158ec5b09058b07b0672ae4850e495ab029b40115e52037bd0248ddf546139aee00a78b442dbee2b5e56bf5653c42d45a5d64271bf

Download Submit
memory/2192-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2192-4804-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2192-13436-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads