f0c91a65f124f71b2ffd0c2893504799705287f6efe65dac715ce88c626cbba3

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73233a39958798b56c97bfdbf7789e92.exe
Size

1.8MB
MD5

73233a39958798b56c97bfdbf7789e92
SHA1

b757ca1eaa49b299c45fc3f70b0a5769a405a80f
SHA256

f0c91a65f124f71b2ffd0c2893504799705287f6efe65dac715ce88c626cbba3
SHA512

2f0244ba6087770245e04d971cecd4dc81a18ba91cfe539a898dbf363d055e93dcd565672c57fda92a9f73dae8b4a33d59621daf1ee3cc1d672527066600da18
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH1:SCqm2Jpr0nNM7Dus7Nx2V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0028000000015596-5.dat	upx
behavioral1/memory/2420-858-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2420-9179-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	73233a39958798b56c97bfdbf7789e92.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Journal\MSPVWCTL.DLL.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.exe	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.exe	73233a39958798b56c97bfdbf7789e92.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties	73233a39958798b56c97bfdbf7789e92.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.exe	73233a39958798b56c97bfdbf7789e92.exe

C:\Users\Admin\AppData\Local\Temp\73233a39958798b56c97bfdbf7789e92.exe
"C:\Users\Admin\AppData\Local\Temp\73233a39958798b56c97bfdbf7789e92.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
214KB

MD5
acc70eb07f77d35ed8ebfa54509b004b

SHA1
8be0225bb86f4cb963c59451d7e5efd4aede09dc

SHA256
fed0c6426bb699ce533b6d635e3955fd2e8666c2d10dcea4adb33afb345f2102

SHA512
4a1b83ad61b3661a7b2992bfd0660c782ac6e23374e2ffcaf1c0134890ce402bc1bf0c603f8ab236b66f5c630a2d4eb847125103a1244d86cab81fc8ea5a756c

Download Submit
memory/2420-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2420-858-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2420-9179-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads