57fd8d7fe3a47c1d6501cbc2e7c3da56d97c4dfe1c0d05321638aeb9fb2ed3d4

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2737c25ebbec8e156d494b09cf9a115.exe
Size

2.0MB
MD5

c2737c25ebbec8e156d494b09cf9a115
SHA1

ff2c41f3caf3a98aa779418b0e6e290e510580cb
SHA256

57fd8d7fe3a47c1d6501cbc2e7c3da56d97c4dfe1c0d05321638aeb9fb2ed3d4
SHA512

131c3e8c1d93077ad01bc77cebbedb6e94193f6a935ff0289de791cacf08f0deb7b3b3c9a61282534f16de4ac0a652dc33bf6be01b3f30c9bb5969f1bae1b57f
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQP1:SCqm2Jpr0nNM7Dus7Nx2kCq1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228b1-5.dat	upx
behavioral2/memory/4852-764-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	c2737c25ebbec8e156d494b09cf9a115.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsound.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsdt.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jre-1.8\COPYRIGHT	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.exe	c2737c25ebbec8e156d494b09cf9a115.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	c2737c25ebbec8e156d494b09cf9a115.exe

C:\Users\Admin\AppData\Local\Temp\c2737c25ebbec8e156d494b09cf9a115.exe
"C:\Users\Admin\AppData\Local\Temp\c2737c25ebbec8e156d494b09cf9a115.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
2.0MB

MD5
32fa773df84a39e848195e6ae05e8071

SHA1
98a164f0d60577311006756dc92a96fe68e28390

SHA256
e6055015d15cff0a587c409f5ed0a79cb88c1798c0e15390fde21ef10502a0a6

SHA512
cd8df1d88952f582a2164f731c503d6d80e8548d22b9b22139c1a160fdc8c5b1c9030cfb70efee2803bd430289045be71d93e09bc47eabb522ade5011902aa18

Download Submit
memory/4852-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4852-764-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads