Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2024 00:35
Behavioral task
behavioral1
Sample
9a53d68b08ae745fc5b6b5b0b6975db2.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a53d68b08ae745fc5b6b5b0b6975db2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
9a53d68b08ae745fc5b6b5b0b6975db2.exe
-
Size
1.8MB
-
MD5
9a53d68b08ae745fc5b6b5b0b6975db2
-
SHA1
bd8a12746e1cadac8ee8405cfdeeff015e0d83b5
-
SHA256
df52ec929fba2aaf1ac9ed847bb819373a2620624fda68e49940b5b39c69ae80
-
SHA512
1a858fa17d2edebd5beb97b84165c92408be91abf72a581874504d534129dbb994e133e88b6385c65a511d4fc6a441a3011948a0472817285a8ad2faa3ff54eb
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHN:SCqm2Jpr0nNM7Dus7Nx2t
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/792-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/792-717-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 9a53d68b08ae745fc5b6b5b0b6975db2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\7-Zip\Lang\va.txt.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.exe 9a53d68b08ae745fc5b6b5b0b6975db2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui 9a53d68b08ae745fc5b6b5b0b6975db2.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak 9a53d68b08ae745fc5b6b5b0b6975db2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5422184dd4ddb7bc0722355041044c6fb
SHA1c1e7a7b73e4efbb87fa1f8231acb60e7646a9fc4
SHA25634e1d40fd9d65dd5e3cbcd51bfa6c1a0e708e757197a0d6d13c4aafd680aa512
SHA512574a76c0635010b19eb8968d54e182de909bd808e445b78e3431cabd933ed52bade982b6f23894a4c3576051f12e83046174bd710d542c81a79c64ea1bd3b42b