063d525d2035acc18d322a43aeddf518a6c1ab4c00f4644259859ce16acc3460

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ecf1305a015a272f8c3e79deb55bcbd.exe
Size

1.8MB
MD5

8ecf1305a015a272f8c3e79deb55bcbd
SHA1

fcd4000ed3dc1e83e24a36fa70d7fac4765dc1da
SHA256

063d525d2035acc18d322a43aeddf518a6c1ab4c00f4644259859ce16acc3460
SHA512

ae409b7a516aff40c602c66b38e5438c8afffe876c8981ed6732602216b99caa42e7c2157860893f97bb3142a4c40ab0abd05fa08771d1a6f1b9c9be54fabc67
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHI:SCqm2Jpr0nNM7Dus7Nx2o

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5964-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228cc-5.dat	upx
behavioral2/memory/5964-4821-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/5964-13417-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\desktop.ini	8ecf1305a015a272f8c3e79deb55bcbd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.Tests.ps1.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ComponentModel.EventBasedAsync.dll.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-black.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200_contrast-black.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\ReachFramework.resources.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Sun.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-100.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-150.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-200.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\logo.scale-200_contrast-white.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\ReachFramework.resources.dll.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-256.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\ThumbAerial.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-200_contrast-white.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-black.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSmallTile.scale-100.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-200.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\clrcompression.dll	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-200.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-125_contrast-black.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-100.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\MilitaryLeft.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-125.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlCone.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-400.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-20.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-100.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png	8ecf1305a015a272f8c3e79deb55bcbd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\FacebookDialog.xbf	8ecf1305a015a272f8c3e79deb55bcbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.exe	8ecf1305a015a272f8c3e79deb55bcbd.exe

C:\Users\Admin\AppData\Local\Temp\8ecf1305a015a272f8c3e79deb55bcbd.exe
"C:\Users\Admin\AppData\Local\Temp\8ecf1305a015a272f8c3e79deb55bcbd.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
21KB

MD5
b864b08e08f2eae92d07503d9b58abb2

SHA1
0b14c9df08f0849e17a0d071de0d19edbae0a773

SHA256
0c843c547affc4fcb33ddf0531c962c163f9ef05673dbdbcce80c298a4b0c22f

SHA512
599cd61887c4d2971af4f0e7d631d9103da2e5ecc68580f24f3108b6d071e82b651f399e39974ed1740804ed64409e3c74d53ed66759bfaa093a72a1b903bcbb

Download Submit
memory/5964-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/5964-4821-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/5964-13417-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads