b9d2f49a06f61bcad417bbda3d2938f50021b27785c0d9faedcfb3f5aae8e378

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7157b4f390cfb18bff09bf6981c5d1e8.exe
Size

347KB
MD5

7157b4f390cfb18bff09bf6981c5d1e8
SHA1

e57ba01779102a01585ca979820630fe50db4f4d
SHA256

b9d2f49a06f61bcad417bbda3d2938f50021b27785c0d9faedcfb3f5aae8e378
SHA512

c7d80f52830bf4b1bd5961b28549e43ac6e63a13aefd94a245f092fb3ae97ec6f0b7a92d4ab010bb9229fffd9895331ebc4b248ffc1502084439bf23d93ea2f8
SSDEEP

6144:HO+TyiE8+aqCjToXVpGOZcWixTmAcThAkZThMTMh:JXEkqeolrix1c60ya

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\desktop.ini	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\desktop.ini	7157b4f390cfb18bff09bf6981c5d1e8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\resource.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\he.txt	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Input.Manipulations.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\sunec.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\it.txt	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\micaut.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\System\wab32res.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-2-0.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsFormsIntegration.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ExtExport.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\COPYRIGHT	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\en-US\wab32res.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationUI.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Numerics.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jfxmedia.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jp2ssv.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jjs.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\wab32res.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-profile-l1-1-0.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Resources.Extensions.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\System\msadc\msadcer.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Primitives.resources.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md	7157b4f390cfb18bff09bf6981c5d1e8.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll	7157b4f390cfb18bff09bf6981c5d1e8.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui	7157b4f390cfb18bff09bf6981c5d1e8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	1880	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\7157b4f390cfb18bff09bf6981c5d1e8.exe
"C:\Users\Admin\AppData\Local\Temp\7157b4f390cfb18bff09bf6981c5d1e8.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 932
  2⤵
  - Program crash
  PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1880 -ip 1880
1⤵
PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
460KB

MD5
de9e71fc5acfaa25e7259ec2738ddd8c

SHA1
d778bbfcedad126e00a21617a4e8568f71d3fc89

SHA256
74bbb0760aa155d74013d261ba709fe18b87043524f8d2920ada2b1cf74e04c3

SHA512
34e07edd7b17150ace6333ae221a9142d50426fe0bde0fa572152289ce9b612aa3fe29b1b5e5319e58351f536b5925473395643dff6f8566fbfd00180b6b378a

Download Submit
C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/1880-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1880-1977-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads