4e53339eee98fa8219df0d00968278cd72d7bde1486c019b310be8ac01fd3387

Analysis

max time kernel
159s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26f797e829b55a70e3bde040c1b82cdb.exe
Size

1.8MB
MD5

26f797e829b55a70e3bde040c1b82cdb
SHA1

6b3fa95f69caa8020dd823bdb2698ce27ec1df6b
SHA256

4e53339eee98fa8219df0d00968278cd72d7bde1486c019b310be8ac01fd3387
SHA512

2664a417c601881978a3c56bb1928fcc33a93e82cbaf622e7dfa00a201c1aa7cc6e44700e0764b79412dbc348b2f0eaf804551bce6b35b9a18ba5e77f63fb647
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq3:SCqm2Jpr0nNM7Dus7NxG

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022910-5.dat	upx
behavioral2/memory/2984-254-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	26f797e829b55a70e3bde040c1b82cdb.exe
File opened for modification	C:\Program Files\CheckpointSearch.wm	26f797e829b55a70e3bde040c1b82cdb.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.exe	26f797e829b55a70e3bde040c1b82cdb.exe

C:\Users\Admin\AppData\Local\Temp\26f797e829b55a70e3bde040c1b82cdb.exe
"C:\Users\Admin\AppData\Local\Temp\26f797e829b55a70e3bde040c1b82cdb.exe"
1⤵
- Drops file in Program Files directory
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
5dbe39e2c52fcdd00b85a5d4c3aa8839

SHA1
fa3562ba7a168a561063a8aa6315a5b162169fb5

SHA256
ed331ccdf1779e4120a9ddd8a44bea5cf74ce46f47ad06000fd430a5a7458898

SHA512
a3f758a75e8aa4e837da2b2105cd3ff1b8cfdfc4bf3abbfc8055f48aa7654eec66bd2a4beecdb38ba96742efeedf98fab2c570d9ef1f9d1c0c93dd277caa19ca

Download Submit
memory/2984-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2984-254-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads