d0bfd89e867636d406556cd3dac659afe1c41259c4e7b1b2671b897841bce5b1

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc3854c21eb271738e9aa13a18cfdcd6.exe
Size

282KB
MD5

cc3854c21eb271738e9aa13a18cfdcd6
SHA1

8443e81a1c6684061b9316035a010a4017010aa8
SHA256

d0bfd89e867636d406556cd3dac659afe1c41259c4e7b1b2671b897841bce5b1
SHA512

f499bad449438739d7ad5fcaed5cc9444fdf35a22d07861b17949ace382d44b4b301298b0401b3a7326d805a90d0caebae150d4c6e7e7e06d74e5a3585d136ca
SSDEEP

6144:P+fAz16PHyf+Tyiq6dPvuuYe0FKZBbHmviDs:P+Iz16fjXPPvuuY3HvP

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\desktop.ini	cc3854c21eb271738e9aa13a18cfdcd6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\adojavas.inc	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\de.txt	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\System\it-IT\wab32res.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\fieldswitch.ax	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\journal.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcfr.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\eu.txt	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DissolveAnother.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h	cc3854c21eb271738e9aa13a18cfdcd6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\mng.txt	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	cc3854c21eb271738e9aa13a18cfdcd6.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png	cc3854c21eb271738e9aa13a18cfdcd6.exe

C:\Users\Admin\AppData\Local\Temp\cc3854c21eb271738e9aa13a18cfdcd6.exe
"C:\Users\Admin\AppData\Local\Temp\cc3854c21eb271738e9aa13a18cfdcd6.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.8MB

MD5
67cad3e6625087893033e920e5c42bf9

SHA1
88a8e018f7d26e64c6cb23685bb71e7f248b0f61

SHA256
673e2ad81a8c0dfb5b156c6f0b825eee75b61df93ef9928a71de2fbf6d8e9df6

SHA512
b86b505556d376724476af0de89fda956dfe6a0ccc7167a1ffc3f20f36724e1afb58bcc419452c7404a98ec2f73e382b27f8ff801cb93359947ad7325091a747

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
memory/2340-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2340-1139-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads