b9c825d954461c8513f6c0bdd34468fb25e447039e905d0fa669ab3d2f63e1a1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8a5ea841e482e78d400503a0c16d1e5.exe
Size

270KB
MD5

c8a5ea841e482e78d400503a0c16d1e5
SHA1

70f1497be3dfc55e029abbd7f13963e1b8eecf56
SHA256

b9c825d954461c8513f6c0bdd34468fb25e447039e905d0fa669ab3d2f63e1a1
SHA512

32fc8dd6a693e8f4193b5e068a4ab9a2b0f88a8fe6eddce818b39aa710684d1e8aee1dc1ffe85913950fd914654e4b35353eb7abdff992677e4b1fef03fef151
SSDEEP

6144:P+fAnXc4W534XA1M2yPKyXBZSg/K8pr6lwj7ch/d:P+AXc4c4B6mjk

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\desktop.ini	c8a5ea841e482e78d400503a0c16d1e5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\ij	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ca.txt	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\fa.txt	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcor.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\en.ttt	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msdaremr.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\Timeline_is.dll	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana	c8a5ea841e482e78d400503a0c16d1e5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ps.txt	c8a5ea841e482e78d400503a0c16d1e5.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	c8a5ea841e482e78d400503a0c16d1e5.exe

C:\Users\Admin\AppData\Local\Temp\c8a5ea841e482e78d400503a0c16d1e5.exe
"C:\Users\Admin\AppData\Local\Temp\c8a5ea841e482e78d400503a0c16d1e5.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.8MB

MD5
ec091c985b548a8c826fccd6ea4ea27b

SHA1
d60a75c79e7415157c63831c96dc304d2537d19b

SHA256
15ab3706bbd7cc3e9da1ba045a4a20648e94f28e0e27fb6d5604f6f4f937aa76

SHA512
bbe74987cf40fac6a9c73f0d017212a56edd6f87b5404bce9799b8cf7335b461f094fa1365fe55496b9d1cda756dd9ead7988ec2478a2b97798f494866bf95f2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/948-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/948-1077-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads