Analysis
-
max time kernel
138s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 00:38
Behavioral task
behavioral1
Sample
4252b58f6ccf2d8248b4de4bae41232a.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4252b58f6ccf2d8248b4de4bae41232a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4252b58f6ccf2d8248b4de4bae41232a.exe
-
Size
1.8MB
-
MD5
4252b58f6ccf2d8248b4de4bae41232a
-
SHA1
1473f168f100a2291f1d00734baa5848e8b1eaa4
-
SHA256
0702505a88457f390f6dd45deda50cd3c23ce508ff0ef10e5fef54ff70cef2e3
-
SHA512
d92e9d637d57395912682ad4a52ccccc7acad9b0f302cb0ae222761db1e5624c866c88298b145f69b8ad112584ef9fac40b7a307c2aa4a99b86a5da19f881f86
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqf:SCqm2Jpr0nNM7Dus7Nxy
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2636-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227bf-5.dat upx behavioral2/memory/2636-259-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\7-Zip\Lang\ps.txt.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\7-Zip\Lang\ja.txt.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\AddRemove.html.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\7-Zip\Lang\sl.txt.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.exe 4252b58f6ccf2d8248b4de4bae41232a.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.exe 4252b58f6ccf2d8248b4de4bae41232a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55529ea1b18bec0fdc0e0f0f576c038d3
SHA132e102963e7ad4230e3851f82580dbb1ba1a197a
SHA256b78a08cea72ec555bdd491e89c3a26681bbe6c7247d9f2770a57fb10e48a62ee
SHA5128b911746183d4ea32c69279c00911aaf353eefed8309fa3e7af445b0912e001c8cf42335748d5daba02aa78afff98ee8e8ed0a9512480a5ce9faa44533e0ca20