fdf108c5b4bab7fef6737b25f52999bf30b6bb337a58d3b8a5ed250234761fd0

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40b792eefce153a86fc2e7a202bbbf43.exe
Size

1.8MB
MD5

40b792eefce153a86fc2e7a202bbbf43
SHA1

2f95afa941ab7baac28646925bbe7e2368f1e203
SHA256

fdf108c5b4bab7fef6737b25f52999bf30b6bb337a58d3b8a5ed250234761fd0
SHA512

13da2e037fecce4cf1a52b9d7ca13e74d6111dad8b34698cd0098b9c434be49a220965cb25d8b6fbaf8cd6c4ca3264b7ccac9fc6641bec87c60d93b68af0980f
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHl:SCqm2Jpr0nNM7Dus7Nx2F

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1320-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0037000000013a7f-5.dat	upx
behavioral1/memory/1320-2534-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1320-9194-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	40b792eefce153a86fc2e7a202bbbf43.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\java.security	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_partly-cloudy.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)grayStateIcon.png	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\library.js	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.exe	40b792eefce153a86fc2e7a202bbbf43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar	40b792eefce153a86fc2e7a202bbbf43.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	40b792eefce153a86fc2e7a202bbbf43.exe

C:\Users\Admin\AppData\Local\Temp\40b792eefce153a86fc2e7a202bbbf43.exe
"C:\Users\Admin\AppData\Local\Temp\40b792eefce153a86fc2e7a202bbbf43.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.0MB

MD5
11e55a62d346b76dc2cfc5a9670b8ff4

SHA1
c3749cac7504065fbc97377021b1e0287fc0d8f3

SHA256
99811d094eeb4f0355077e71e3bdae14eda1bba0fa748afeefa07d891c9252be

SHA512
0731a5060525109585cc431c351371229e5dc173cb36489e0fb1d35858e120e0800957356fbad318641f03c0bdad8c5d4cdf90ae03881151f94ccbdc9abead3f

Download Submit
memory/1320-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1320-2534-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1320-9194-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads