5fdfb85d8b8ee68058e167290717b52589895b7cd9f22aa3ad56ec2bff1f8506

Analysis

max time kernel
132s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d7589703b50f9bbd99dbb5409cee2ca.exe
Size

2.8MB
MD5

8d7589703b50f9bbd99dbb5409cee2ca
SHA1

6ab108b6d8ed0dd93cdc348514393a9dd5c9fb30
SHA256

5fdfb85d8b8ee68058e167290717b52589895b7cd9f22aa3ad56ec2bff1f8506
SHA512

0625669200a8fbfe5f7ce48da67747463973ee81af656024a50f2e4070faa9d16698ad54efaaa3e7a54d26fccf153f98517a2fc262721f78ae1322489c1040f3
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91f:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x002600000001529f-5.dat	upx
behavioral1/memory/2184-512-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	8d7589703b50f9bbd99dbb5409cee2ca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\EnterExport.asp.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgRes.dll.mui	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\libvlc.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\ExitCompress.svg.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\notificationserver.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.exe	8d7589703b50f9bbd99dbb5409cee2ca.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar	8d7589703b50f9bbd99dbb5409cee2ca.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll	8d7589703b50f9bbd99dbb5409cee2ca.exe

C:\Users\Admin\AppData\Local\Temp\8d7589703b50f9bbd99dbb5409cee2ca.exe
"C:\Users\Admin\AppData\Local\Temp\8d7589703b50f9bbd99dbb5409cee2ca.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
2.8MB

MD5
047b40a19d87a32a5ff0bfcd8e5651ea

SHA1
1dd072fb9e7b3e097cc187da83edd870f4229edb

SHA256
b60057aef3c667a7de1234cab6264d0c937095afafc3af90be64d5ff093ba49b

SHA512
719016161846f2c0e3a570fbf3ef20dd85cca76e7a5f15e65f9919c7454c5b279a14f8b9b96b85fcc60f05f099a233953a419fc82ce685e5bac8a4fade5e1a92

Download Submit
memory/2184-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2184-512-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads