Analysis
-
max time kernel
2s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:33
Behavioral task
behavioral1
Sample
24999382ba86ef0569c7728c84b30eff.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
24999382ba86ef0569c7728c84b30eff.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
24999382ba86ef0569c7728c84b30eff.exe
-
Size
1.8MB
-
MD5
24999382ba86ef0569c7728c84b30eff
-
SHA1
7e52a1108a24ecca9ac775ffeccd0882050dd3d6
-
SHA256
a728eb1381c36d8a35b970a307f5ffd621963295f0a81242105b3282898d23bf
-
SHA512
d08819d59dd2b04513485c8f39d0ef829ffe23b1e37911f5e578773c40bd7af52f9de0bc5ad89eaa8eb0590df44dc4c496e852c08ee1f52d5ccdd07d775e1038
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHi:SCqm2Jpr0nNM7Dus7Nx2C
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x003500000001564e-5.dat upx behavioral1/memory/2196-2653-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2196-9221-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 24999382ba86ef0569c7728c84b30eff.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\7z.dll.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\sk.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.exe 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\readme.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\si.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\CheckpointShow.ttf.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\it.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\lt.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\7-Zip\Lang\nb.txt.exe 24999382ba86ef0569c7728c84b30eff.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.exe 24999382ba86ef0569c7728c84b30eff.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.exe 24999382ba86ef0569c7728c84b30eff.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD59b40c5fecc584d988a6616c1caaacdff
SHA1d02dc025166b549c36987d6db5098771d34629fb
SHA256fa15427be34f2b9a8baae1a7e5467015c2a495a63c47e031baf39bac69130b3b
SHA512417572c9a0c8ff260304d0242a81549e62ec853a7f2f7284d5dc1ed8f18040fa0e7218a009ebe2b5f7f2ebfab2b4e635ad6fcb74c25e86271973f272ba60d894