684efc514572e2584c39b806e8ecb435fc2645a24edde36c53d0cf72944adaed

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47623eb27c0652309e1f9b41cb607594.exe
Size

1.8MB
MD5

47623eb27c0652309e1f9b41cb607594
SHA1

dd65542d9ba67e460b267e588902834697bf61f3
SHA256

684efc514572e2584c39b806e8ecb435fc2645a24edde36c53d0cf72944adaed
SHA512

a9c4ebd8419ca44f7b7b9446cab9b6c2fbbf76b0eefbd08f7ff7fa718ca0ccb2bb8816d7fbacac2083b8063e24c57affd4cda0d1623241313665512609c9dc31
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq/:SCqm2Jpr0nNM7Dus7Nx6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1536-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228a0-5.dat	upx
behavioral2/memory/1536-5951-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/1536-13378-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\desktop.ini	47623eb27c0652309e1f9b41cb607594.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-1497073144-2389943819-3385106915-1000-MergedResources-0.pri.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-150_contrast-black.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\LargeTile.scale-125.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-64_contrast-white.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Parallel.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingEngine.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-400.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vcamp140_app.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-100.png	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-40_contrast-black.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MicrosoftLogo.png	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\TellMeOneNote.nrr.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-lightunplated.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\refresh_16x16x32.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Mozilla Firefox\qipcap64.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso40uiimm.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-lightunplated.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Classic.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Resources.ResourceManager.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\7px.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlMiddleCircleHover.png	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.jpg.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJHBD.TTC	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-125.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Json.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsBase.resources.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Design.resources.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationUI.resources.dll.exe	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll	47623eb27c0652309e1f9b41cb607594.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso50win32client.dll	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-100.png.exe	47623eb27c0652309e1f9b41cb607594.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png	47623eb27c0652309e1f9b41cb607594.exe

C:\Users\Admin\AppData\Local\Temp\47623eb27c0652309e1f9b41cb607594.exe
"C:\Users\Admin\AppData\Local\Temp\47623eb27c0652309e1f9b41cb607594.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.3MB

MD5
7bc1c83f9e64dac85c6aed00ff231b3b

SHA1
711b13676853bb8f4336296ca2314d789c2d38ec

SHA256
cc8ae3b1069fe67f6a09884faba49c72dfe650de02749d064060fc155eaf7b30

SHA512
8bf04852acd2c68dd93d00f35b6e4f2d78b9c235e9aa4878ea063dfe4b52bf6fb0904a9d22063e63b48c809ae53ae4f49e3464ebc0e06c0fcf7418b5bb75b1e8

Download Submit
memory/1536-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1536-5951-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1536-13378-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads