9cc99c7c767ccde0a9dfa99d39f957f613891d0e174f53ee1aac9453b4dc3f91

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8786055981257ec777fe0d8a0e20c178.exe
Size

1.8MB
MD5

8786055981257ec777fe0d8a0e20c178
SHA1

97efb957aef7386977f8ea5c2cc7cc7a59296f91
SHA256

9cc99c7c767ccde0a9dfa99d39f957f613891d0e174f53ee1aac9453b4dc3f91
SHA512

4bafd9aae50cc34a6287b06e36715687ad38ce3089c5ba5bf808e85f7f7ad573e49d844b42871d03efc5c7a6ba629793121ae0bb62fdb5c911879013afa5e054
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHf:SCqm2Jpr0nNM7Dus7Nx2/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3752-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00010000000228a0-5.dat	upx
behavioral2/memory/3752-6439-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/3752-13385-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	8786055981257ec777fe0d8a0e20c178.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-lightunplated.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-fullcolor.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\content-types.properties	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Dismiss.scale-80.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\2px.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-200.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-unplated.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\dismiss.contrast-white.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\ormma.js	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\MicrosoftAdvertising.ini.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-100.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-150.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\WideTile.scale-200.png	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Primitives.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_NinjaCat.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\3DViewerProductDescription-universal.xml	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-100.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-400.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODEXL.DLL	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\6.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-100.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\ReachFramework.resources.dll.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.exe	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\WindowsFormsIntegration.resources.dll	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-150.png	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Encoding.dll	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-400.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\3DViewerProductDescription-universal.xml	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\ValueProp_Ring.png.exe	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	8786055981257ec777fe0d8a0e20c178.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\swscale-5_ms.dll	8786055981257ec777fe0d8a0e20c178.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms	8786055981257ec777fe0d8a0e20c178.exe

C:\Users\Admin\AppData\Local\Temp\8786055981257ec777fe0d8a0e20c178.exe
"C:\Users\Admin\AppData\Local\Temp\8786055981257ec777fe0d8a0e20c178.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
965b2592368f1cdbc2e442344f724b00

SHA1
5c1d6f944614637da9b6a91e5d256a39ad110d69

SHA256
7ee1478ec3e91776f5372e0b9d9b93032208b123df12839206f105afac967886

SHA512
acb99d5d8a4a9997f8b0119ef6c7e8ecaca3175f25ca5fa8288077ca74def7f289dbb9312cc02e80d9ee6f9aa6640b9e637dac921511e4392d6cfa6406db58ab

Download Submit
memory/3752-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3752-6439-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3752-13385-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads