4f7f0e5746943c6c5d64ecf906f8540c842ad6275dacc0144d05f070c928a976

General

Target

74f4aed732c61e9a1e8c86fc73add304.exe
Size

241KB
MD5

74f4aed732c61e9a1e8c86fc73add304
SHA1

9827c2ae5d2f45270b31c8d814cc0972a5e584be
SHA256

4f7f0e5746943c6c5d64ecf906f8540c842ad6275dacc0144d05f070c928a976
SHA512

09d7adb8d32502962a43694d0ad0cc51f42c26249ab76abf6ec7a141bb717dc648992ed6b7c15ff647f341293baec2eaaba136aa41ce59e32fe80c59c9750d54
SSDEEP

3072:BnEOei99xNKkOzyIT2PzfTyRNrex1amaYA9Y2ibyZdI4CC2AXxrciu1BHTOSPP:He+fAz16PHyK2bcyT55K9PP

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

Processes:

74f4aed732c61e9a1e8c86fc73add304.exe

description	ioc	process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\desktop.ini	74f4aed732c61e9a1e8c86fc73add304.exe

Drops file in Program Files directory 64 IoCs

Processes:

74f4aed732c61e9a1e8c86fc73add304.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\7-Zip\Lang\hr.txt	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\msdaosp.dll	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Internet Explorer\pdm.dll	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\OmdProject.dll	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\pt.txt	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi	74f4aed732c61e9a1e8c86fc73add304.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	74f4aed732c61e9a1e8c86fc73add304.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos	74f4aed732c61e9a1e8c86fc73add304.exe

C:\Users\Admin\AppData\Local\Temp\74f4aed732c61e9a1e8c86fc73add304.exe
"C:\Users\Admin\AppData\Local\Temp\74f4aed732c61e9a1e8c86fc73add304.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll
Filesize
5.8MB

MD5
b53a3c4b6b4d83292f88eb3a7d53a40a

SHA1
a13aa9b4530f8ab8f0292ac751c1292b87462631

SHA256
72f5a1fe9cefc10828ed28364f7f456e33e7f06acc13a17a0d5e98ed6c55bb3f

SHA512
9d76daca1d061b2afab870f15305840852413a27817e1c1de490e4d2a1dda06a078809a10e0d9b9c216038774f0c3bf1b12435b702951ebfa00f9deef3e12e32

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib
Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
Filesize
7KB

MD5
6a922ae3979f4cd80d73e62711c19826

SHA1
4cc0a5bf46db54e1c54059394fb9f64b95d4ef69

SHA256
9cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61

SHA512
a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3

Download Submit
memory/952-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/952-1304-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads