Analysis
- max time kernel
155s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 04:18
Behavioral task
behavioral1
Sample
4a6af68adec57b4926db881f170b0f89.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a6af68adec57b4926db881f170b0f89.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4a6af68adec57b4926db881f170b0f89.exe
- Size 1.8MB
- Sample240108-ew3aeaahem
- SHA256 ddc5cd7b540c88f00bd8d685e4d4fce54b6223757d66599d02c22c718fa17ccd
- MD5 4a6af68adec57b4926db881f170b0f89
- SHA1 01970b9e2b23a4498cba226b8525428589677de6
- SHA512 13ed2cd58376c9f1ac5a575c87db348bf674eb821e18aef50042c8ea28314dff0ed7afbe0c90ec37790643d79b929f503466ab30f434c0fdcfe2cd5ea2189078
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHO:SCqm2Jpr0nNM7Dus7Nx2u
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4460-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/4460-216-0x0000000000400000-0x00000000005BA000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\7-Zip\Lang\ar.txt.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Internet Explorer\IEShims.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\7-Zip\7z.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\7-Zip\Lang\is.txt.exe 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui 4a6af68adec57b4926db881f170b0f89.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.exe 4a6af68adec57b4926db881f170b0f89.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.exe 4a6af68adec57b4926db881f170b0f89.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 5e1142c7768c7f8c6370b3e587c04b8beec0399f3639d9df67a72b0662189f7c
- MD5 a883bce6529558cf89fd7a1dfd902eca
- SHA1 de414f51d1d7da45ae66f4582cd739d3bd3041b0
- SHA512 ba736d1cd2764e0c3e7d52908a4003a38c34c5ed5f2a7c8f81aed50a72c0fa01edb6b00b41d79a409facd74be099675a442e8efc59922969b22799f6321be906
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHr:SCqm2Jpr0nNM7Dus7Nx2L
- MD5 SHA1 SHA512 SSDEEP