Analysis
- max time kernel
156s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 04:22
Behavioral task
behavioral1
Sample
4a6d5261e5e909f62132215061f8d670.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a6d5261e5e909f62132215061f8d670.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4a6d5261e5e909f62132215061f8d670.exe
- Size 1.8MB
- Sample240108-ezblvscad2
- SHA256 1025a49cc417a4da087d84ba25bc27ae682177e2f46a9f755e847517a08401ca
- MD5 4a6d5261e5e909f62132215061f8d670
- SHA1 035780deb2fabc1c5cc1a68cd06928413d24ca88
- SHA512 de171aff09ec2c134863ac53056b8a9bf29ee218585bffbae3422d7e28d161cb0fabe131a9033fd28040cadd27b45f2aaac827ae31b9a5300a6c4d52bf501244
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqVs:SCqm2Jpr0nNM7Dus7Nxz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2220-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/2220-240-0x0000000000400000-0x00000000005BA000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\7-Zip\Lang\fa.txt.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\management.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\7-Zip\7z.exe.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\7-Zip\Lang\ta.txt.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\awt.dll 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\7-Zip\7z.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\7-Zip\Lang\ba.txt.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\packager.jar 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.exe 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md 4a6d5261e5e909f62132215061f8d670.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.exe 4a6d5261e5e909f62132215061f8d670.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui 4a6d5261e5e909f62132215061f8d670.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 a5066563bcc4a3d19cf326ff581d3d9ebe25cf4938bece5a3d8f51717e0c6820
- MD5 3a06df5102bff96fcaf0716a31c3f6c5
- SHA1 4caf41976a98ed566ca7f9b7a6e5f728ebe66737
- SHA512 939efda0aa3c7fb16e87bea4485f54a99d86ad4d580ff33d202779f0ce81742036b74128e83a0c0c4665582e6e700bd0a878acc2752e24741bc0ba5141cebe43
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqVt:SCqm2Jpr0nNM7Dus7Nxa
- MD5 SHA1 SHA512 SSDEEP