73f306c086c8bcbfc2fa218a133cab1a5e435df89a770f5888cf5eeede1ff35d

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281672cd2e6863b3231840c5c8bf0fab.exe
Size

1.8MB
MD5

281672cd2e6863b3231840c5c8bf0fab
SHA1

cd7908ac10d8e0c600eb13194dd9204736e382c5
SHA256

73f306c086c8bcbfc2fa218a133cab1a5e435df89a770f5888cf5eeede1ff35d
SHA512

5c64589f1f02f04cfae376ecd7f94027bc93147f9b96fe2d1a5196693eef349d3e9451c585c69597955eeba6e842f1879ad8c7474854fe966c0c4ffa4a866e72
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHD:SCqm2Jpr0nNM7Dus7Nx2j

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3060-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000227bf-5.dat	upx
behavioral2/memory/3060-540-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\CloseImport.xlsx	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\7-Zip\7-zip.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.exe	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui	281672cd2e6863b3231840c5c8bf0fab.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.exe	281672cd2e6863b3231840c5c8bf0fab.exe

C:\Users\Admin\AppData\Local\Temp\281672cd2e6863b3231840c5c8bf0fab.exe
"C:\Users\Admin\AppData\Local\Temp\281672cd2e6863b3231840c5c8bf0fab.exe"
1⤵
- Drops file in Program Files directory
PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.1MB

MD5
dbdb4266eacd3e1031b8bc272508eeee

SHA1
3af98c8db7fc7ed05451af338d717e36d83fcc7d

SHA256
b374c0d0ad4880b8cce3049289b543bd0dcd41afb35591d07adb59685cd11904

SHA512
9601103b938f4aa711dbf60a31ec01698ce7a9c65a1b2a67406f46d98b267c36b70aa86f2e37bf0bd630bf7080e1cff44f4660200014de2a6b2823196e78ff17

Download Submit
memory/3060-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3060-540-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads