Analysis
- max time kernel
6s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 04:23
Behavioral task
behavioral1
Sample
4a6e23148858c85439b7ce2a6cc0fe43.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a6e23148858c85439b7ce2a6cc0fe43.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4a6e23148858c85439b7ce2a6cc0fe43.exe
- Size 1.8MB
- Sample240108-ez8llacae5
- SHA256 43d60fbdb6f18efcc0cb2db743510fb08c08f34f10d4eccff674b8793c9e0e1e
- MD5 4a6e23148858c85439b7ce2a6cc0fe43
- SHA1 9c54f2ecc5d29abe88a4e48176f0c0de1d44ca1e
- SHA512 c0b401ed88b3f4f04b889b8f4a24763caa5c1880dfdbf22ff5a7dd728ec51dd6536c886a2943cbd50c843b53fb3bfdcf2cf20bc5fa3f4e2afee0534517c8168a
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHD:SCqm2Jpr0nNM7Dus7Nx2j
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4684-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4684-4038-0x0000000000400000-0x00000000005BA000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\msader15.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\7-Zip\Lang\br.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\7-Zip\Lang\sl.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\7-Zip\Lang\gu.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\7z.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.exe 4a6e23148858c85439b7ce2a6cc0fe43.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll 4a6e23148858c85439b7ce2a6cc0fe43.exe