Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 20:33
Behavioral task
behavioral1
Sample
4460095436074b48a8c2a490dd35d85d.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4460095436074b48a8c2a490dd35d85d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4460095436074b48a8c2a490dd35d85d.exe
-
Size
1.8MB
-
MD5
4460095436074b48a8c2a490dd35d85d
-
SHA1
650071339558638997f3a1d778dca820ae6062bb
-
SHA256
5e4ed2bdec0ebb214409441189bbed1444e4764968779132afe9761d9b292a84
-
SHA512
82c79e5d8bdeb1ef148db39c4e993049ae4cb22074de2ce84b7049e329371856f8e1f975841123b62f3cf6c69af18dd66b5b44ff363ca8e033e0b38a924e17ec
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqt:SCqm2Jpr0nNM7Dus7NxQ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000a00000001342b-5.dat upx behavioral1/memory/2028-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2028-3041-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2028-9187-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 4460095436074b48a8c2a490dd35d85d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\localizedSettings.css 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\7-Zip\descript.ion 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\DVD Maker\rtstreamsink.ax 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.password.template 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.exe 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 4460095436074b48a8c2a490dd35d85d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol 4460095436074b48a8c2a490dd35d85d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_rest.png.exe 4460095436074b48a8c2a490dd35d85d.exe