3d1f1aacec0831a266bfd5f3bf822ffa90118d9ad775c7d6b5b0403e0ea918be

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65ce2162f4b3b9bf8347db2885079981.exe
Size

375KB
MD5

65ce2162f4b3b9bf8347db2885079981
SHA1

e6b660a2f03641228a1729456ba44ced19532425
SHA256

3d1f1aacec0831a266bfd5f3bf822ffa90118d9ad775c7d6b5b0403e0ea918be
SHA512

757be17310aa133fe41983513b44b02c7eef055908d837b8fa1a2fa05016d868bd8e8e6333cc7f6f51b46c57e68ead98f0b4112bfa39358b438e318809436b91
SSDEEP

6144:HO+TyiE8+aqCjToXVpGOZcWixTmAcThAkZThMTM:JXEkqeolrix1c60y

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\desktop.ini	65ce2162f4b3b9bf8347db2885079981.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Internet Explorer\perfcore.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\BackupStop.tif	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\F12.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\F12Tools.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\SecretST.TTF	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\hu.txt	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ug.txt	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\System\de-DE\wab32res.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\Common Files\System\msadc\msadco.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\sqmapi.dll	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\gl.txt	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png	65ce2162f4b3b9bf8347db2885079981.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat	65ce2162f4b3b9bf8347db2885079981.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui	65ce2162f4b3b9bf8347db2885079981.exe

C:\Users\Admin\AppData\Local\Temp\65ce2162f4b3b9bf8347db2885079981.exe
"C:\Users\Admin\AppData\Local\Temp\65ce2162f4b3b9bf8347db2885079981.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.9MB

MD5
7679b7f814045e0f33c0a7b4e3740a92

SHA1
ef778e12e945ed51e72f6ebd300332c99d6362a5

SHA256
73d5e37902c976b8dcf8d7adc4cb2b336716b730358e592744891be93670cf05

SHA512
79b12d09dd04d85bd2a7e1c71687b53ffc8656911cc45d5a7272883587f462bae7a5b137932b80b77598a59893f072f7d7f25ae61c432a76dabce99cfeb855e8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer

Filesize
5KB

MD5
6b99099c6a9b959f824e420676fe3dc8

SHA1
ba9e3b5f2f7f710d263272019be5bf5db33bf614

SHA256
34d5d8dc208ef8c73bb46fb3002fa22b8954d52a4e53be3c56b9801aeab56918

SHA512
dfe061ddec4106e68c8ea789009b0e6bf7d27072bebd0bdb724e4ccadd215b9122b04198bbc362753e2b35af16d993ddf89b44b29bb79c0e7a16eeb97f3b3d26

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-559-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads