7e52b9c39674f1025cd2d72b55b1340b0dc6be393062f39a434b4eef4b31b01b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274866c2adcd15078fb6f130f10f5d55.exe
Size

2.8MB
MD5

274866c2adcd15078fb6f130f10f5d55
SHA1

87af8440c881c5764576a038614b541c7009bdb9
SHA256

7e52b9c39674f1025cd2d72b55b1340b0dc6be393062f39a434b4eef4b31b01b
SHA512

9dda19dfcc50b3f47676c5a2b0910fe1c2cfc633440aba2c1c9d3991634cee3206fc8a310c7993108f3f8725b845ee4b59f8f6fdb3db3e55e1049a506b4edde6
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV916:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nG

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1448-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x003700000001508a-5.dat	upx
behavioral1/memory/1448-2392-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1448-8157-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	274866c2adcd15078fb6f130f10f5d55.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\Sidebar.exe.mui	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.exe	274866c2adcd15078fb6f130f10f5d55.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.exe	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png	274866c2adcd15078fb6f130f10f5d55.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.exe	274866c2adcd15078fb6f130f10f5d55.exe

C:\Users\Admin\AppData\Local\Temp\274866c2adcd15078fb6f130f10f5d55.exe
"C:\Users\Admin\AppData\Local\Temp\274866c2adcd15078fb6f130f10f5d55.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
129KB

MD5
4ecbb3b33e69bf49dcfe542a67ec83e6

SHA1
f9cd5c85f9b19a6afa711d8332de9fc804927c99

SHA256
03a155bc41e904d8685baac560daf1250268e497d84abdeb5fed94c49532f421

SHA512
3f09e456692b190eb7b7bd474c602bbab9ab90aa695a61b4aa8f77d1425f05b1a40acc0de232ae54ba65fd2b3145ef8daab8eab3bb298c3f4e9e2be0f48f31ad

Download Submit
memory/1448-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1448-2392-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1448-8157-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads