Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 05:59
Behavioral task
behavioral1
Sample
d55fdb8d0885970faa149eba8cd01759.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d55fdb8d0885970faa149eba8cd01759.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
d55fdb8d0885970faa149eba8cd01759.exe
-
Size
1.8MB
-
MD5
d55fdb8d0885970faa149eba8cd01759
-
SHA1
370bbc934ae76c8a3c85d3783cc2faf456e0e12e
-
SHA256
ecb8eee886dfb5be587f8236fdc535a5e516fe6cac06438d19ca47c0a083e517
-
SHA512
cae0dcb5ad6cefdfab737de30cd19a9fdf5e998ba37e808f9d28ad82723594eca56a87007be64db5ec90c849cdcdec2168705038f1f0a1efb4fb404dfa464eed
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqy:SCqm2Jpr0nNM7Dus7Nxj
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1652-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227dd-5.dat upx behavioral2/memory/1652-1099-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d55fdb8d0885970faa149eba8cd01759.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.exe d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.exe d55fdb8d0885970faa149eba8cd01759.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash d55fdb8d0885970faa149eba8cd01759.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui d55fdb8d0885970faa149eba8cd01759.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5a771cbc2be9789bdd90f09bcaebcaffb
SHA146bdb46ff328e7f398b64af480e0a3a12a9ad9db
SHA2560ea75d699e3e29943c8e72f957cfcd626572fa4a8a6a9241af10d5c241b429e0
SHA51222765d95cf8eed16e9223d13bf430d2839266fc710010fa99b40ede08e77d908ecbb0c0bcd28e3ad48af2ff337005ec6d95a608ca4b2a828de4b380ba148028d