8378693dc1dc740de3c84464e30833d26f3abc78028a3e9a66bb5dfbdd9755ba

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f8febe84411e90f6cc76a12e948618.exe
Size

1.8MB
MD5

56f8febe84411e90f6cc76a12e948618
SHA1

55286df05df489f66bd01630d3735704554154cd
SHA256

8378693dc1dc740de3c84464e30833d26f3abc78028a3e9a66bb5dfbdd9755ba
SHA512

8b27a3b3de7730fd0c9490e60c6bbc36b49b7803d9e3bfd51891b6db803d32e6e7279d772676263816ba3631230acdf10175862d0650cc1d6794e97fcabf83c1
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHg:SCqm2Jpr0nNM7Dus7Nx2A

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3796-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228ac-5.dat	upx
behavioral2/memory/3796-6172-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/3796-13418-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\desktop.ini	56f8febe84411e90f6cc76a12e948618.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125_contrast-black.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_CatEye.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\web_chrome_permissions.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-white.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-125.png	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-150.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Extensions.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Logo.scale-100_contrast-black.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-16.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-400.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_contrast-white.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-150.png	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-125_contrast-white.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200_contrast-black.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Xaml.resources.dll	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ir.idl	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-200.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\ConfigurationManager.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.dll.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\175.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\igxim.dll	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-60_altform-unplated.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72_altform-unplated.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-150.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-125.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-200.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-200.png	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-200.png.exe	56f8febe84411e90f6cc76a12e948618.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	56f8febe84411e90f6cc76a12e948618.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png	56f8febe84411e90f6cc76a12e948618.exe

C:\Users\Admin\AppData\Local\Temp\56f8febe84411e90f6cc76a12e948618.exe
"C:\Users\Admin\AppData\Local\Temp\56f8febe84411e90f6cc76a12e948618.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1024KB

MD5
6f3c31a880db3e9e35945c17aaae34d8

SHA1
cf09444cc59521ad1cca8632581dcad9977d96a8

SHA256
1cbdb1a76150f6b3bd910bd6e17a5dbd40ef31427d64e87231b5e4ea73dffafb

SHA512
db07930d9ff7688e01ec30b3849c24d60245b8fe68f6b40d7fa9d2629a72e86fe4d862c28a5840815af6373cdc1fbacc7202e62a91aa35da73582b324aca6e4d

Download Submit
memory/3796-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3796-6172-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3796-13418-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads