a983bc91fd0d11a55f98c24b26754421cb63cc323e61ac8722dd08d7b2b5a126

Analysis

max time kernel
139s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89a4774d9bec6c5bfbbc90b18f047ebf.exe
Size

1.8MB
MD5

89a4774d9bec6c5bfbbc90b18f047ebf
SHA1

06a48314b260f13b8e3289011b6c701b33cfedb4
SHA256

a983bc91fd0d11a55f98c24b26754421cb63cc323e61ac8722dd08d7b2b5a126
SHA512

5df80233f815e2e6c55a907d166823a47bc8894204982228dd253f9ac6ef39f11a403bc7da54f2ac56d13e561659255f1204e6a74cdcbf3c73b3857857f17aa2
SSDEEP

24576:N6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqWLCv2:NCqm2Jpr0nNM7DuQ7NxoO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/848-0-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral1/files/0x002d0000000142b4-5.dat	upx
behavioral1/memory/848-580-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral1/memory/848-9206-0x0000000000400000-0x00000000005BB000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	89a4774d9bec6c5bfbbc90b18f047ebf.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\dnsns.jar	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\it-IT\sbdrop.dll.mui	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Regina	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.exe	89a4774d9bec6c5bfbbc90b18f047ebf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi	89a4774d9bec6c5bfbbc90b18f047ebf.exe

C:\Users\Admin\AppData\Local\Temp\89a4774d9bec6c5bfbbc90b18f047ebf.exe
"C:\Users\Admin\AppData\Local\Temp\89a4774d9bec6c5bfbbc90b18f047ebf.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
73baff08b620c1edf61daf86e2866dc3

SHA1
3cf8a974d604f3ff7704fb44b628d1738457dc68

SHA256
ecff3fb122f45c59e0755659249887220313d6becc0296c7e3163e2c66470801

SHA512
30d5d406cd11a04da40a327c3d811846fad9f1248dfaab304abced9f57a4400e92530f5aa9d928fce058b037beecc1cc938c36128ac8b1dc3a9f448f1fc42486

Download Submit
memory/848-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/848-580-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/848-9206-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads