6274f73013797f251bfe3a1dc4cd1d5a46271665bfc43485cf770f2d37d8c950

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96613eec069258b206424665e4e5031a.exe
Size

1.8MB
MD5

96613eec069258b206424665e4e5031a
SHA1

d3489e5c067dafb7a7eb6ff851b913f4f82cac31
SHA256

6274f73013797f251bfe3a1dc4cd1d5a46271665bfc43485cf770f2d37d8c950
SHA512

84d45aa4984bf37fc8046258573fc22ec1e09721bc5d8f7a1e86a1f336f7793d8eeb915e68d5e19892d07308875e5e174dbc99d500e640f40fd04ec7770801c7
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqj:SCqm2Jpr0nNM7Dus7NxC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0009000000015cfe-5.dat	upx
behavioral1/memory/2936-2916-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2936-9200-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	96613eec069258b206424665e4e5031a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\sbdrop.dll.mui.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\wlsrvc.dll	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.exe	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem	96613eec069258b206424665e4e5031a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.exe	96613eec069258b206424665e4e5031a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar	96613eec069258b206424665e4e5031a.exe

C:\Users\Admin\AppData\Local\Temp\96613eec069258b206424665e4e5031a.exe
"C:\Users\Admin\AppData\Local\Temp\96613eec069258b206424665e4e5031a.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
1.8MB

MD5
9bbe3825c3d2dd93ddfb17010210dc1c

SHA1
455ea7d8aa42252a13cd6e52849f0d111ecf2b6b

SHA256
23cedb17a32bbbcbe20edec571d111847c6c8159b10682c88ccee728b8a24e34

SHA512
95cbc49ae26d7001d233b34dc5953199365490e211dd829fd176083f3528792df8fa48169796aa78d2175b5885eeeedd12b8709e47b847acc5e2faa5dee2d5a8

Download Submit
memory/2936-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2936-2916-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2936-9200-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads