9722ab26cc8cde2276883e88fa3054a48437cf0da1e37407b7026dc338f65c4e

Analysis

max time kernel
148s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3767b9730cc126e942241bbea63876a2.exe
Size

1.8MB
MD5

3767b9730cc126e942241bbea63876a2
SHA1

5926f1751c6e3e2bd6a4fb0cf9f51c5a7dc1b366
SHA256

9722ab26cc8cde2276883e88fa3054a48437cf0da1e37407b7026dc338f65c4e
SHA512

36e3cec1768b395df75ed1dfbe5b217c370ff02ce6cfe55dcb1185fd00aa0ac7d16ba4e1a45035a2aafa561da71d46b11a8476e100c67c32a6faf00039d23948
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxql:SCqm2Jpr0nNM7Dus7Nxg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/228-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022897-5.dat	upx
behavioral2/memory/228-6183-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/228-13399-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\desktop.ini	3767b9730cc126e942241bbea63876a2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-400.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\5.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Cng.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-80_altform-unplated.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.ps1.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_uk.json.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxManifest.xml	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-24_altform-unplated_contrast-black.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-40_altform-unplated.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\8.rsrc.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-400.png.exe	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-32_altform-unplated.png.exe	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-200.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-64.png.exe	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Linq.Parallel.dll	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-150.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-200.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-48_altform-unplated.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.OpenSsl.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO40UIRES.DLL.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\VALoading.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-100.png.exe	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.resources.dll	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-200.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-400.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W3.png	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\WelcomeDialogContent.json.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-200_contrast-black.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\NETWORK.INF.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-20_altform-unplated_contrast-white.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-400.png	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileLargeSquare.scale-200.png.exe	3767b9730cc126e942241bbea63876a2.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.strings.psd1	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png.exe	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.Extensions.dll	3767b9730cc126e942241bbea63876a2.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png.exe	3767b9730cc126e942241bbea63876a2.exe

C:\Users\Admin\AppData\Local\Temp\3767b9730cc126e942241bbea63876a2.exe
"C:\Users\Admin\AppData\Local\Temp\3767b9730cc126e942241bbea63876a2.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
662KB

MD5
506625e7a0cd5bc4635476ea0d5bc254

SHA1
40e98af700c57736b3a9b803bfffffea48591aab

SHA256
33c125f0aecb1bf7cc58704c3b568ff8bdbbe261b9bc5d2cf5ec2ec26e188ed9

SHA512
51bb337f83966c7adaf5776f3fd7b520272ec9b716be285b92097bb2db6273e02a912189a9533e0054d91627a8a81f1ac0b4b30d89ba9ad4ebab814fef1723fb

Download Submit
memory/228-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/228-6183-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/228-13399-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads