Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 06:54
Behavioral task
behavioral1
Sample
66fa7a1bee88191d4a933f2a3fabe243.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
66fa7a1bee88191d4a933f2a3fabe243.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
66fa7a1bee88191d4a933f2a3fabe243.exe
-
Size
2.8MB
-
MD5
66fa7a1bee88191d4a933f2a3fabe243
-
SHA1
f18123c6a6f7478714458e11f4c32b84aaf8bed5
-
SHA256
420ca519ae5e81e5b22a7f07c533dee3a5e1be802ad3a1c991328386682272b1
-
SHA512
4deccae6d57ab6e64539ddf4ea1c8cc9eb8a852b0cd6c17cb5552333cdb2ab6c0053a35964b515cf13d22dd5968f29ddc6abec07bd72e8136d61e5c6349896ff
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91Y:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0n0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1492-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/1492-551-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jdk-1.8\release.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\7-Zip\History.txt 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\meta-index 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\C2R64.dll 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms 66fa7a1bee88191d4a933f2a3fabe243.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.exe 66fa7a1bee88191d4a933f2a3fabe243.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb 66fa7a1bee88191d4a933f2a3fabe243.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD548f875ca60a9fee20838de2c4bdbb373
SHA17da9fb7f302f0004e6cdc6d8ecb65cbf8b4b5d30
SHA2562f40bc3977485a4a8434e3ed716baf0b6e284041ccff8176324a8dbd95015a70
SHA512a5e37671e51f90bacc269b130763517c415b2d8ad884114cf03cf37a5f7ed9d01bb9c92635274dfa155615cc54e584f3df81cb82bffd120abdcaa82da006615a