Analysis
-
max time kernel
156s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 17:26
Behavioral task
behavioral1
Sample
3d714c2f92e9ac1571369429091489ed.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d714c2f92e9ac1571369429091489ed.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3d714c2f92e9ac1571369429091489ed.exe
-
Size
1.8MB
-
MD5
3d714c2f92e9ac1571369429091489ed
-
SHA1
4f12e655e032b8e321f5d9893d48c20c3a52e0ac
-
SHA256
5a4acf16496e4ebdf7cacf3abf59905db0bd26cb79045c820be7e508c39093b8
-
SHA512
f5e34341688ad270e32a77d838d69f3c8aa115862e32bd0ebb469a4e42e9d5d3d0a15039d2c715c6d87c7bdfa18a99e709712c29bb9f11aa21b3e0ef50f6eb21
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHQ:SCqm2Jpr0nNM7Dus7Nx2w
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4584-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/4584-141-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\7z.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\ExpandDebug.inf.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\CheckpointSend.wmx.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\ar.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\uz.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\7z.sfx.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\lv.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\fi.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\bn.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\mng.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\tr.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\cy.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.exe 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.exe 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 3d714c2f92e9ac1571369429091489ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.exe 3d714c2f92e9ac1571369429091489ed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll 3d714c2f92e9ac1571369429091489ed.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5123f6ec6c8c386f7ed34f8d3a8ce8fa6
SHA1a061ba8af64e8d268e5495977835773c5e55d019
SHA256c5d13e68bf1398c33dfa8e903ff809bbc6867dafd4427c88cdc96079ee3e55f0
SHA512be1a35131aa0eae82972eca2b66f0b8943e5fe2f01adf312483a72e45d8332e13c52026bf144a5f241d291bf5af82e948deb4d84366ccecdf623335418839ffc