a0ccd22997892f6576df3e827a99335229faa9a0f08cf0a11684211c7a3696ae

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcfccabce752943f2fecad3ba5bff778.exe
Size

2.8MB
MD5

bcfccabce752943f2fecad3ba5bff778
SHA1

0595fd9b262d08bf87302977d95707668094735c
SHA256

a0ccd22997892f6576df3e827a99335229faa9a0f08cf0a11684211c7a3696ae
SHA512

248df139cdbf9e064fa70d8166222f5ae655206284313933ca4d98c0e7ee9332bfce36cf260c3c52f879ac37945c20b79e63f1209fb888bbb60ab95f95bd04a8
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91C:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0n+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228b1-5.dat	upx
behavioral2/memory/4772-419-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\sunec.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.exe	bcfccabce752943f2fecad3ba5bff778.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.exe	bcfccabce752943f2fecad3ba5bff778.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	bcfccabce752943f2fecad3ba5bff778.exe

C:\Users\Admin\AppData\Local\Temp\bcfccabce752943f2fecad3ba5bff778.exe
"C:\Users\Admin\AppData\Local\Temp\bcfccabce752943f2fecad3ba5bff778.exe"
1⤵
- Drops file in Program Files directory
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
2.8MB

MD5
0b7cab6ba19ab74540733673c7a3b526

SHA1
68f2cb91b41a6f9e256573125e654359cf03a976

SHA256
aa9f18416925844558bfa248552cbbbba8712ff2ee9423b0f624d579a158d70a

SHA512
8dbc12b0e58b7d8f661b581e2c5355e08238a6feb41cf38713d56515911acce09128589e457134ccc6edf09dee7dc258cd4742c02560948372c2eed2c78ab295

Download Submit
memory/4772-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4772-419-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads