2416204a86fe0c81bd29e687d467e55ac3eb6635db23cace4a02cdf87877afdd

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a1db86c16967ca319f5d21e2eeec459.exe
Size

1.8MB
MD5

7a1db86c16967ca319f5d21e2eeec459
SHA1

45d1450f6f06967c9afdc62f4f196be2ae839feb
SHA256

2416204a86fe0c81bd29e687d467e55ac3eb6635db23cace4a02cdf87877afdd
SHA512

5dcaf485dccfffb185b46ad0d1792223d0e50421cf65acc8affdbb1ce8e05f66066968c6025f6e6bf11cf4c08c31ec9fb97197bc4f0e1e196a98f57cd80c74b7
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH9:SCqm2Jpr0nNM7Dus7Nx2d

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3336-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228ac-5.dat	upx
behavioral2/memory/3336-5791-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/3336-13387-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\desktop.ini	7a1db86c16967ca319f5d21e2eeec459.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-125.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-200.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-white.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-colorize.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppValueProp.svg.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-80.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-lightunplated.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\BuildInfo.xml.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-100_contrast-black.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\resources.pri	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.DataContractSerialization.dll	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-black.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-400.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-white.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\MedTile.scale-200.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-125.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-24.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlConeHover.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-125.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ms-logo-no-text.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-48.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-100.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-unplated_contrast-white.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.AdomdClient.dll	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcp120.dll	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.Imaging.dll	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-36_altform-unplated_contrast-white.png	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Java\jre-1.8\COPYRIGHT	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\29.jpg.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-150.png.exe	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	7a1db86c16967ca319f5d21e2eeec459.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	7a1db86c16967ca319f5d21e2eeec459.exe

C:\Users\Admin\AppData\Local\Temp\7a1db86c16967ca319f5d21e2eeec459.exe
"C:\Users\Admin\AppData\Local\Temp\7a1db86c16967ca319f5d21e2eeec459.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
473KB

MD5
4dd9799849bcd1461b5f12bc8944c971

SHA1
8f1b78b621a78c65604febe801a5cff5907a33e2

SHA256
5609ab04b7de06b81026c12703bc2ce07c1f2207dbd15ce4ba1c7dec1f20abb5

SHA512
0e5b8dfdeb175530dbd7919da293d658922c8502e6fc7ba873dc9a6abda9c2ffcad7de4cfe2b0c80f607e5c4d4bf15fb3ff61f34f3121d35a3e3cf5cc8428086

Download Submit
memory/3336-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3336-5791-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3336-13387-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads