0a08f079172ce58f33eda867d5fc8fe6259a23ba66633c9300d1e4c14701d358

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

657b8252a5900240e3d0962bcb6114a3.exe
Size

350KB
MD5

657b8252a5900240e3d0962bcb6114a3
SHA1

97d3be03d8f73e4be9729af9d7f650c52074ee1e
SHA256

0a08f079172ce58f33eda867d5fc8fe6259a23ba66633c9300d1e4c14701d358
SHA512

6a7f923912375cb95673d0e4be8285dfa71d9cc7fc7e207c314db51e1034ba47792c09ce3decc32ef00322e019cba54e3ef5aced2a3d3b45f0d97bbfb8e9ef81
SSDEEP

6144:VEFMFnW+TyiFL7yaBhu4QMaUu6wBN45Iwk6MTX+71f1tscX+ay:VEFMFnhXFLGWgMaUlC45I0Eu71/by

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	657b8252a5900240e3d0962bcb6114a3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msdaosp.dll	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msado21.tlb	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\F12Resources.dll	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\images\bing.ico	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msxactps.dll	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\jsprofilerui.dll	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nb.txt	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Services\verisign.bmp	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\7-Zip\7-zip32.dll	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png	657b8252a5900240e3d0962bcb6114a3.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	657b8252a5900240e3d0962bcb6114a3.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png	657b8252a5900240e3d0962bcb6114a3.exe

C:\Users\Admin\AppData\Local\Temp\657b8252a5900240e3d0962bcb6114a3.exe
"C:\Users\Admin\AppData\Local\Temp\657b8252a5900240e3d0962bcb6114a3.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.9MB

MD5
283c3ca66f50acdc81fc710558a179dc

SHA1
cb46c99ddf339d738406a23a0646cd7d0bacbb99

SHA256
b65095c94845f3285d74349f6121c43f1fd41e57d01f0220beb8e67c38edf2cf

SHA512
c8dc2d7731a97d5edcc699fe5bc65839ca44ee256107061cf200afff3274e0e55e21e49893a95e66ca924dbb1beddf9cf7f8e68b0eb207fb65d62056bc409a67

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer

Filesize
5KB

MD5
6b99099c6a9b959f824e420676fe3dc8

SHA1
ba9e3b5f2f7f710d263272019be5bf5db33bf614

SHA256
34d5d8dc208ef8c73bb46fb3002fa22b8954d52a4e53be3c56b9801aeab56918

SHA512
dfe061ddec4106e68c8ea789009b0e6bf7d27072bebd0bdb724e4ccadd215b9122b04198bbc362753e2b35af16d993ddf89b44b29bb79c0e7a16eeb97f3b3d26

Download Submit
C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/1736-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-47-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-241-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-359-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-362-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1736-630-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads