Analysis
-
max time kernel
157s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 16:34
Behavioral task
behavioral1
Sample
c918910a36ed481c2bf0baef022f1526.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c918910a36ed481c2bf0baef022f1526.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
c918910a36ed481c2bf0baef022f1526.exe
-
Size
1.8MB
-
MD5
c918910a36ed481c2bf0baef022f1526
-
SHA1
fbdc0451887e9d8511cb505f4720d5a29bfaff86
-
SHA256
38a244760874f05e7bc4c2a5f03bddb13be9338e3ff667e63fca4e0d9cd7ef5a
-
SHA512
84d9f69b39dd44ae0c27afcb3114faaf9e530dcdbeff13707fa42284c425779f30db944b0f7771f1733f2e216017152f6873bbcae74bcb31edf25a98b460d6dd
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqt8:SCqm2Jpr0nNM7Dus7Nxn
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/228-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228b1-5.dat upx behavioral2/memory/228-576-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\README.txt c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jdwp.dll c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\lib\calendars.properties.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.exe c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\7-Zip\7-zip32.dll.exe c918910a36ed481c2bf0baef022f1526.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.exe c918910a36ed481c2bf0baef022f1526.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c918910a36ed481c2bf0baef022f1526.exe"C:\Users\Admin\AppData\Local\Temp\c918910a36ed481c2bf0baef022f1526.exe"1⤵
- Drops file in Program Files directory
PID:228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=764 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:1168
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD515c6a632e6e53ee04694878354e28e55
SHA1dafd6acbfed5d8b8546bb2549d3a7b26317520ea
SHA2563b532dedf063d7526b2c1d5994d0f1add9d89c34a3765e7ada8bd5de3f2fd2bc
SHA512f7130df9e858d098967e647ef40ed2f9fa351e75fd9299b221697ec4308cf2e4ce59225be58bf035f82e96376b1e111565dec9623b9f1fd057b42d552b9f33a2