Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 06:54
Behavioral task
behavioral1
Sample
cac42358cdb16196f02fff7daf87a1c0.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cac42358cdb16196f02fff7daf87a1c0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cac42358cdb16196f02fff7daf87a1c0.exe
-
Size
1.8MB
-
MD5
cac42358cdb16196f02fff7daf87a1c0
-
SHA1
2c5519687168104dc644e6fdfac4a47c8d0d230f
-
SHA256
50559c2af78fe4c4de540e4db8876cda89a0155f596d50159198fd875615addd
-
SHA512
c625d151a767888ef7ae8539884efa24b0fc68995c06396e9e6bfbf0d9d078a9d488c00b07f5d9a1105fb9cebf246613eec6a127ab4e845e3202f68ccee4a9a0
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqfp:SCqm2Jpr0nNM7Dus7Nx2p
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3932-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228b1-5.dat upx behavioral2/memory/3932-723-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\7-Zip\Lang\ms.txt.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Internet Explorer\iexplore.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\7-Zip\Lang\fa.txt.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe cac42358cdb16196f02fff7daf87a1c0.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar cac42358cdb16196f02fff7daf87a1c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.exe cac42358cdb16196f02fff7daf87a1c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac42358cdb16196f02fff7daf87a1c0.exe"C:\Users\Admin\AppData\Local\Temp\cac42358cdb16196f02fff7daf87a1c0.exe"1⤵
- Drops file in Program Files directory
PID:3932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:2248
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5c9ce3f4b7ea8f539329a910fc684cd8f
SHA1376a816785183eb53a5c1d50e7f0c968d0c4e16d
SHA2564239c9b1879015c9fd35d7f843369bea6fba5ec80b80aec788408de63c65c269
SHA512db2bdf68924f981420e6062cddba40081bb017572bb61d8ed6742f1ac172dc7730903bdfe3acc5e6cad33f4705929dba61ea5ec359b4ee627d18b468bd4ae813