Analysis
-
max time kernel
160s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:20
Behavioral task
behavioral1
Sample
2b843c48d2d7fafa33e0a8f9dcc02c74.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b843c48d2d7fafa33e0a8f9dcc02c74.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2b843c48d2d7fafa33e0a8f9dcc02c74.exe
-
Size
1.8MB
-
MD5
2b843c48d2d7fafa33e0a8f9dcc02c74
-
SHA1
97c587c4f37f7746e1fe84cdaaad406bab484db4
-
SHA256
e791b39bbf8d1a4d66f43205adcbdf7dc33eb2db0a96ec1ee0873d94444d90e0
-
SHA512
c3b5031f025220689ae1b5458aca11a64464147fc6a2d06889f83736dbb48207a5dae5a7dea25a34d8f05c1f92447f9aab5261c12b037781ec5f31058252f18c
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqw:SCqm2Jpr0nNM7Dus7NxZ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1316-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227a8-5.dat upx behavioral2/memory/1316-470-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\ConfirmAssert.ttf.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\DenyUnlock.3gpp.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\wab32.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\ExitMount.mpeg 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.exe 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml 2b843c48d2d7fafa33e0a8f9dcc02c74.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 2b843c48d2d7fafa33e0a8f9dcc02c74.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5539c250c11ffa4371b1ffd41bb827525
SHA1ee2e9dbf2fda58f2d1bb70dab1e38279dc03fd2d
SHA2568e76ec086c2591024546de9591975ce40beb9b489348030afbae749d2dd9f371
SHA512a0fb6af16589070760a96527b0fa6fbcbd84b608d1074e1319d9e3343f7676272d1d1d7b52d1f573546868eef2c5ba740494684bee02046ebf20548eddfe73f8