Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 20:40
Behavioral task
behavioral1
Sample
8d4b6c8467d2a9899687bcc934bfd8bd.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d4b6c8467d2a9899687bcc934bfd8bd.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8d4b6c8467d2a9899687bcc934bfd8bd.exe
-
Size
2.8MB
-
MD5
8d4b6c8467d2a9899687bcc934bfd8bd
-
SHA1
e6d1ca0f02b2e0c5cc880be343f1c38144e3a10f
-
SHA256
d1360ca071ea79897b28251c74d9770c3520c602e75d0a0052e2abe42a80b203
-
SHA512
3e3715e6dcd2beef665e9b811cdbc5d09422a15d60762ae0be96051be6facebe98bc302b008a63604818faeb3ec186e95801d489e1f2c50bcee5865e29debd19
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91X:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nj
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4320-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/4320-729-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\7-Zip\7-zip.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\7-Zip\Lang\sw.txt.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.exe 8d4b6c8467d2a9899687bcc934bfd8bd.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5e2a6748dfaf3f21f0aa3e41b206f747d
SHA106605c6bd32936236d71ac699db11f19d403a717
SHA2565191bca3c66d460e24f716a9eb1e1ca689d7eac3b2bc8a0d90e2778d00a98b89
SHA512ae321d39018026b9b688e05e05d644a2f64054781e191095e42876b100487e1e8ccc678bd9e67fdd4b6795f20095e7e020e358c908530a4800f22a597a096f7f