dfc282a9674654275235f5f21445a4963b5d22795272d1aa3ca097c429d7c931

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
Size

1.8MB
MD5

c4b5fdc87fa8c29fea4ccdc19cee8d19
SHA1

a6d550b5e94749f0a248ea77e6598db2d8406a87
SHA256

dfc282a9674654275235f5f21445a4963b5d22795272d1aa3ca097c429d7c931
SHA512

4bc9f66878f5f5f9a220b88aa24bb4b85d97f816e320066faae17d6b316728fb7f68aa49057ea765f8cebcffde0fcef8521d5b2182a3384e92dfff2dca3c4851
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq0:SCqm2Jpr0nNM7Dus7NxF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4108-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000022893-5.dat	upx
behavioral2/memory/4108-5663-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/4108-13434-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\desktop.ini	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-white.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXmlLinq.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-125.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-100.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\It.ps1	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-white.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Snooze.scale-64.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.ELM.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\IncomingCallBrandingImage.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-96.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsFormsIntegration.resources.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-black_scale-100.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\black.gif	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-64_altform-unplated.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\vfs\System\mfc140enu.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\THMBNAIL.PNG	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AriaWrapper.winmd	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClient.resources.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-200.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-200.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsLargeTile.scale-100.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\avatar_round_mask.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\LibWrapper.dll	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-100.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.WindowsRuntime.UI.Xaml.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-200.png.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Permissions.dll.exe	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-lightunplated.png	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\CT_ROOTS.XML	c4b5fdc87fa8c29fea4ccdc19cee8d19.exe

C:\Users\Admin\AppData\Local\Temp\c4b5fdc87fa8c29fea4ccdc19cee8d19.exe
"C:\Users\Admin\AppData\Local\Temp\c4b5fdc87fa8c29fea4ccdc19cee8d19.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
1d0d717d1bd7d9953d608533042099f8

SHA1
e3b537e29444c08042aa7fc807fb0ffd9f682a1c

SHA256
5be0110825622c70b21de5530801dceecf21aeda3e7a209f48887108fdce03e2

SHA512
3ec88e3312070e41024afa79c4239db46aef4033d24ec8c791450e075170450fe60ab421acf07c21925f90bfac2fdc29d7618de2417123cb448eb57fb914e975

Download Submit
memory/4108-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4108-5663-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4108-13434-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads