Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 21:18
Behavioral task
behavioral1
Sample
7095924372ffb6944291ee9e54e0f2cf.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7095924372ffb6944291ee9e54e0f2cf.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
7095924372ffb6944291ee9e54e0f2cf.exe
-
Size
1.8MB
-
MD5
7095924372ffb6944291ee9e54e0f2cf
-
SHA1
0934eb485e66d4349ee3516ef994f9e8ffded5c1
-
SHA256
ac3fe35a157b0a9988f7e90ef3104ffbbceec491db16da155c131d4f278df654
-
SHA512
06cd81befbb1ebf8102f52976230b4effd15963bf7df92376c38e50e32914d128d62bb7fa09a6449c9d6f860e81372a579e7cf3cfb5f82fbc2a31216b4b9bf7a
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq7:SCqm2Jpr0nNM7Dus7Nx+
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x00300000000146a2-5.dat upx behavioral1/memory/2188-376-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 7095924372ffb6944291ee9e54e0f2cf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.exe 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\7-Zip\Lang\tk.txt.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\ExitStep.M2T 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\7-Zip\Lang\fi.txt.exe 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\7-Zip\Lang\mr.txt.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.exe 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png 7095924372ffb6944291ee9e54e0f2cf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.exe 7095924372ffb6944291ee9e54e0f2cf.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5043bf0004a788c5d862a3a6181e10655
SHA16fe07c8db52bb0218f30469f9f7177e6593346cc
SHA256b78ff1c4e926953e7353127ad65739cbda6011da1da111a94ec689032e6c2b77
SHA5121b30b8af308142b5fc426799638ce6b767df80233b2f14a00c00b88c4682dc79ffa952a6b16b9930abd48efffef22424409b00a025da6647a0e3f9daff8fd880