Analysis
-
max time kernel
167s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 04:09
Behavioral task
behavioral1
Sample
278e25f523631ade719cc06585c66a61.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
278e25f523631ade719cc06585c66a61.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
278e25f523631ade719cc06585c66a61.exe
-
Size
1.8MB
-
MD5
278e25f523631ade719cc06585c66a61
-
SHA1
89bc6f797a1aee457c1a5afb2010bc939cb18f8e
-
SHA256
bd7dda7a8718ea96be1f7e408ddee04089d3de04b14c293e3876f3084c9afa54
-
SHA512
5f8f5abf371eeb978a2d6c3ebadde95a75482e216f21af686b85f4e7e36590b349156ebcbfd39aa5c9f5e8984c0337c885b863a07cbcfbdea56686c9f8bf209b
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqc:SCqm2Jpr0nNM7Dus7Nxt
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1984-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227a8-5.dat upx behavioral2/memory/1984-634-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\7-Zip\Lang\sq.txt.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Internet Explorer\iexplore.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\7-Zip\7z.dll 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.exe 278e25f523631ade719cc06585c66a61.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.exe 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui 278e25f523631ade719cc06585c66a61.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.exe 278e25f523631ade719cc06585c66a61.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
901KB
MD5cc437cf9fd59884d9d7f962650be0039
SHA157fb2ebcd48a7420a19f78ae361988323cab3166
SHA2563696d00335527c8fcc66626223d64e8e6bb7682f5c1a82224e4ec311df5d5615
SHA5129e022094e02573f45ade2d420744d81b802efd3c610e5315f0393b5c34ee89a2c37c4d9f4c02da803585a2e63eabbea7ddd2e6c593219d0f984434683485c0ea