Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:50
Behavioral task
behavioral1
Sample
26f797e829b55a70e3bde040c1b82cdb.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
26f797e829b55a70e3bde040c1b82cdb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
26f797e829b55a70e3bde040c1b82cdb.exe
-
Size
1.8MB
-
MD5
26f797e829b55a70e3bde040c1b82cdb
-
SHA1
6b3fa95f69caa8020dd823bdb2698ce27ec1df6b
-
SHA256
4e53339eee98fa8219df0d00968278cd72d7bde1486c019b310be8ac01fd3387
-
SHA512
2664a417c601881978a3c56bb1928fcc33a93e82cbaf622e7dfa00a201c1aa7cc6e44700e0764b79412dbc348b2f0eaf804551bce6b35b9a18ba5e77f63fb647
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq3:SCqm2Jpr0nNM7Dus7NxG
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/292-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/292-2727-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/292-9203-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Chess\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 26f797e829b55a70e3bde040c1b82cdb.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\7-Zip\Lang\ca.txt.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\DVD Maker\sonicsptransform.ax.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Prague.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Media Player\wmpshare.exe.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jre7\lib\psfontj2d.properties 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\7-Zip\Lang\gl.txt.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.exe 26f797e829b55a70e3bde040c1b82cdb.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.exe 26f797e829b55a70e3bde040c1b82cdb.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.exe 26f797e829b55a70e3bde040c1b82cdb.exe