890caef3b4ef377498da6bb92ef67e897a0a6505413416a0459fee6374554c45

Analysis

max time kernel
42s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

563756d78919f27836e077f63e81fea2.exe
Size

1.8MB
MD5

563756d78919f27836e077f63e81fea2
SHA1

12f191a2df027203d5e6a263c852b3b94f7df440
SHA256

890caef3b4ef377498da6bb92ef67e897a0a6505413416a0459fee6374554c45
SHA512

17af513b3d6cdcaab8297929cd6d77e7ea33c4ad64afb3bad258698cf1708f193f911dd7f4e0d724f27a1ec9c683389f3f78833914350068eda2e41475ecc767
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq/:SCqm2Jpr0nNM7Dus7Nxu

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4532-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228b1-5.dat	upx
behavioral2/memory/4532-6235-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/4532-13385-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	563756d78919f27836e077f63e81fea2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\System\msvcr110.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcp120.dll	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOPRIV.DLL.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-timezone-l1-1-0.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\IETAG.DLL	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll.exe	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSSOAP30.DLL	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-125.png	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	563756d78919f27836e077f63e81fea2.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png.exe	563756d78919f27836e077f63e81fea2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	563756d78919f27836e077f63e81fea2.exe

C:\Users\Admin\AppData\Local\Temp\563756d78919f27836e077f63e81fea2.exe
"C:\Users\Admin\AppData\Local\Temp\563756d78919f27836e077f63e81fea2.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
a680e7a66c71737ecc0e0de568e1b7c6

SHA1
e6af46a3ab5983808b83de35285c0a2948792897

SHA256
46c6626c63bc8c8f1f8d181055e3ea1d1770733763c9827949f1166fdf9dc5f5

SHA512
c80ac266117bcb598bb537d4091fa49db2b2ac3113fe06aaaf5cd349f79289e42c67fee2151e1e5f91ef0d7743631544d22fe1ae5fc82d8d3e4985727f5e5dfd

Download Submit
memory/4532-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4532-6235-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4532-13385-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads