Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:11
Behavioral task
behavioral1
Sample
3767b9730cc126e942241bbea63876a2.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3767b9730cc126e942241bbea63876a2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3767b9730cc126e942241bbea63876a2.exe
-
Size
1.8MB
-
MD5
3767b9730cc126e942241bbea63876a2
-
SHA1
5926f1751c6e3e2bd6a4fb0cf9f51c5a7dc1b366
-
SHA256
9722ab26cc8cde2276883e88fa3054a48437cf0da1e37407b7026dc338f65c4e
-
SHA512
36e3cec1768b395df75ed1dfbe5b217c370ff02ce6cfe55dcb1185fd00aa0ac7d16ba4e1a45035a2aafa561da71d46b11a8476e100c67c32a6faf00039d23948
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxql:SCqm2Jpr0nNM7Dus7Nxg
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2936-3111-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2936-9165-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\desktop.ini 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3767b9730cc126e942241bbea63876a2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ru.txt.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Currie 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Mozilla Firefox\precomplete.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css.exe 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.exe 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar 3767b9730cc126e942241bbea63876a2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar 3767b9730cc126e942241bbea63876a2.exe File created C:\Program Files\Java\jre7\bin\policytool.exe.exe 3767b9730cc126e942241bbea63876a2.exe