Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:17
Static task
static1
Behavioral task
behavioral1
Sample
74f36b834a5cf31d6d7ac9f4dc1fd92a.exe
Resource
win7-20231215-en
General
-
Target
74f36b834a5cf31d6d7ac9f4dc1fd92a.exe
-
Size
454KB
-
MD5
74f36b834a5cf31d6d7ac9f4dc1fd92a
-
SHA1
2f108d1d6b0a368c614037530374466a5f6ac2ee
-
SHA256
48919ce83b33b880c83f3de655d6869f8e7cf41fbd874e2c7cf957bba6d9c5e4
-
SHA512
bbd4ee33619fe8ff3fc1ef5a1bf072bbde79f5098a0ae3affacf268525ba481ea4f4e0d3311e007e37c1169e20ccdaf33b44fbebeb4bd07d5464a6130a332fa7
-
SSDEEP
6144:P+fiFEGPOln4RUOeincdvjQl5pqhogsKOGruOB3uRy9Aoe:P+gPOV4uOeinsMqHsRIAL
Malware Config
Signatures
-
Drops desktop.ini file(s) 6 IoCs
Processes:
74f36b834a5cf31d6d7ac9f4dc1fd92a.exedescription ioc process File created \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\$Recycle.Bin\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
74f36b834a5cf31d6d7ac9f4dc1fd92a.exedescription ioc process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Internet Explorer\en-US\F12.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Internet Explorer\networkinspection.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\include\jni.h 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\offset.ax 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\cs.txt 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\System\ado\msado15.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\System\msadc\msdarem.dll 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui 74f36b834a5cf31d6d7ac9f4dc1fd92a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dllFilesize
4.4MB
MD58d81100a1ca48d4d64bac28fa6ceb68a
SHA118d4ff314bc3960c89809ce03590bbcaef30615a
SHA25617a62a3823c44d2debc5e2c1a1eeeb364a8c928a6243a6c5308a8b96f396f4e7
SHA512674bf74303c3f46d1f5f27fb8a2395fab247459f4fc5653ad4fbeefd8f5d515eef1bba5f92b0fe3c4f84473c8e90fae55970019df8827806013e0c1e618fd72c
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jarFilesize
5B
MD5b5b682b742431a52ea8b17c72ad9c572
SHA1326320f469235708c59f678c9a7357dca552d306
SHA25630d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
SHA5124e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD5386b6087dd9575fc6b8ada0f7a463723
SHA15373d4ffd89438a60b8ae0858c3bc4e8d37f540a
SHA256ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1
SHA5121d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
8KB
MD58ed35e04c7556933d923ee706f8312d7
SHA115b0c7aae539b756640e9d28e6f68d82bd5b9294
SHA256f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7
SHA5123f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.infFilesize
62B
MD5f6dbc4b34179e10f9b6c0e2d5d24c2c6
SHA11c53d71700022886c41b568a9514924fd3c1c62b
SHA25605df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206
SHA51225a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSAFilesize
7KB
MD56a922ae3979f4cd80d73e62711c19826
SHA14cc0a5bf46db54e1c54059394fb9f64b95d4ef69
SHA2569cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61
SHA512a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3
-
memory/2136-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2136-1304-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB