afca8dd2dc2668b84db2bdc01623cf93ce3d0e3a814c8bd332fa8df5c6607018

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cd0481ba30fbbd10c557d5fd2064b58.exe
Size

1.8MB
MD5

2cd0481ba30fbbd10c557d5fd2064b58
SHA1

3659f1fef54cb70c385c55eb77cf78aa88f82489
SHA256

afca8dd2dc2668b84db2bdc01623cf93ce3d0e3a814c8bd332fa8df5c6607018
SHA512

a5e806d43ac66578e1f2a67953f94d7d0d6c23ee39e66d53db7a8f158a7050e85c5e90d2ad83816f8cfe38f89423a54d484ef3177fbb7f6caad9b5bc813aa3de
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH6:SCqm2Jpr0nNM7Dus7Nx2a

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0038000000016d1e-5.dat	upx
behavioral1/memory/2336-2527-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2336-9227-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	2cd0481ba30fbbd10c557d5fd2064b58.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.dll	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\sidebar.exe.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\RenameExit.cfg.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Mail\MSOERES.dll.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar	2cd0481ba30fbbd10c557d5fd2064b58.exe
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll	2cd0481ba30fbbd10c557d5fd2064b58.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.exe	2cd0481ba30fbbd10c557d5fd2064b58.exe

C:\Users\Admin\AppData\Local\Temp\2cd0481ba30fbbd10c557d5fd2064b58.exe
"C:\Users\Admin\AppData\Local\Temp\2cd0481ba30fbbd10c557d5fd2064b58.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
381KB

MD5
2e6c5fa5421dc2472b426f9e20bb1a8d

SHA1
858ea62ed936482d0139a2a9f72f6471efb52c02

SHA256
cc29fe4d92038da803cb7fb2b12fd66ed619f330a923a3ff4914cd1c37061ed9

SHA512
1801fe226fe479c26e616e68d0f0b460565e81fc47485baf376f54c32c9e761b39dee0958b198be68a6b4388afd12e29070196f54475c8821831f0b6c6ac407f

Download Submit
memory/2336-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2336-2527-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2336-9227-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads