Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 04:10
Behavioral task
behavioral1
Sample
527f092f6b8ef1dc5f0a094cd746aef5.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
527f092f6b8ef1dc5f0a094cd746aef5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
527f092f6b8ef1dc5f0a094cd746aef5.exe
-
Size
1.8MB
-
MD5
527f092f6b8ef1dc5f0a094cd746aef5
-
SHA1
0893270458992b5f999006016a4668959b447bb9
-
SHA256
726df6380404de539326543190bfaa0d7f88a7d9723ab5ebb502013ced96526e
-
SHA512
52f499bcd75203f0561305dacb8462427a071eed0612ba99578032fb63e0693a848f0a756aec977a69c9bb0477f4bb011e5198d1ddef63d478cccce4f4c84007
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqK:SCqm2Jpr0nNM7Dus7Nx3
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4644-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/4644-968-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 527f092f6b8ef1dc5f0a094cd746aef5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.exe 527f092f6b8ef1dc5f0a094cd746aef5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms 527f092f6b8ef1dc5f0a094cd746aef5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD505ed7bc15113e7e4110a0819528b590e
SHA1dde4233c9dcfc11dd692246be7c9c950454d48d3
SHA2568b30c2755d305c506da4b3ad60bd4cae6857ab3b891f347e5dbaf69d894ab041
SHA512c73aadd9e4641b5a416b2c13c11db1eb25d43bf57c52abbe3d62c5acc16f18509640c8719a91977dcc8f403c1b4ebc809d7a8e590c164530974a4327b6d147d6