e0d7c2b4b1005d27b1b24b357e83a722a58b5a75aafe336aa289b9cd6fb5fd5a

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8313c27e6a918075519ef4b282664c6.exe
Size

1.8MB
MD5

c8313c27e6a918075519ef4b282664c6
SHA1

60e4213c25baf0bf500a2580642edd5823777941
SHA256

e0d7c2b4b1005d27b1b24b357e83a722a58b5a75aafe336aa289b9cd6fb5fd5a
SHA512

98cf9d5d5cf3d972c0baa461d294f0a52144925bd4a3771401348813cc00829d16d4147d67b9fe54c657f5112d7a896844eccab3c4891af5e6ccc2bcd32e3e36
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHO:SCqm2Jpr0nNM7Dus7Nx2u

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1208-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228b1-5.dat	upx
behavioral2/memory/1208-529-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\FormatDismount.mp2v.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.exe	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.exe	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms	c8313c27e6a918075519ef4b282664c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.exe	c8313c27e6a918075519ef4b282664c6.exe

C:\Users\Admin\AppData\Local\Temp\c8313c27e6a918075519ef4b282664c6.exe
"C:\Users\Admin\AppData\Local\Temp\c8313c27e6a918075519ef4b282664c6.exe"
1⤵
- Drops file in Program Files directory
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
6df7b6b344c2dea69a308d0ab9a89e64

SHA1
c65e2f0428aea968fdc77b93a7b0e77e7b683d79

SHA256
e939d025ed26a7bb75dc1f7992ec60ca07a286ecf60c45f6b8b7505b1c766d82

SHA512
32c386820ef3c6f0a8870e70922431229765fb535c6875c914a8ac750bfc4778ce96c44cf46a10c5c9c41b2c850184a92a640aee948f1319cd6e2d5a7b2c06fe

Download Submit
memory/1208-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1208-529-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads