8ab2b4a71c570105f06d91c301c433bb7a6660faf44d1f55c6b7d65e7617d769

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50ce193f718e9388ff73124645108642.exe
Size

1.8MB
MD5

50ce193f718e9388ff73124645108642
SHA1

1a278c1ee486cb7785680f1192c6de550f2da04f
SHA256

8ab2b4a71c570105f06d91c301c433bb7a6660faf44d1f55c6b7d65e7617d769
SHA512

ae1fd68a229039ebe52e491df7014de82b32040ba7b37cfd40942f942af1d4a37d501574d03762387d17752f8cfe025a82e6049af5e0c2f6cc586b1324f1ed8d
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqua:SCqm2Jpr0nNM7Dus7NxO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0012000000016cf7-5.dat	upx
behavioral1/memory/3004-600-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	50ce193f718e9388ff73124645108642.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\7-Zip\readme.txt.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\flavormap.properties	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Vancouver	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\VideoLAN Website.url	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2native.dll	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.exe	50ce193f718e9388ff73124645108642.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.exe	50ce193f718e9388ff73124645108642.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.exe	50ce193f718e9388ff73124645108642.exe

C:\Users\Admin\AppData\Local\Temp\50ce193f718e9388ff73124645108642.exe
"C:\Users\Admin\AppData\Local\Temp\50ce193f718e9388ff73124645108642.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
91218e4fc0fab09137e8583f8e5b2eb6

SHA1
7041abe4ddbb207bb6d59235a4490c4b9abefaa7

SHA256
d2f3fac2cfcc119ede0dcccb0fff2042bc2ce2d5bcba301fdfe7255b141b0e26

SHA512
11d0a30f0b7dbad26100ba2e78aeb9399a96168144cad108dc05fce7471d4288714b4572916df927f89ba22a6d792a8e5217a354fe11697666f918d72aeeb415

Download Submit
memory/3004-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3004-600-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads