Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 20:01
Behavioral task
behavioral1
Sample
d6fe86128269fddfb97c70c7236dafa4.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d6fe86128269fddfb97c70c7236dafa4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
d6fe86128269fddfb97c70c7236dafa4.exe
-
Size
1.8MB
-
MD5
d6fe86128269fddfb97c70c7236dafa4
-
SHA1
2ae3e35165db7a6dd4c20e5b248b1a66f75d849a
-
SHA256
16637c139ed2ed615f5586be9ae4e715dac333ffbd407ba1be9cc0aca62f1afe
-
SHA512
d88808d644427bcbd37d15a3e480c777b47a510a34797048ace3ee07d248f4a6e11c00fbba9051f7cd71b4d9402a3c06783646dd5d8f4ae0693358282542ed14
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqW7:SCqm2Jpr0nNM7Dus7NxV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4192-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227dd-5.dat upx behavioral2/memory/4192-961-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d6fe86128269fddfb97c70c7236dafa4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\bci.dll d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy.jar d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.exe d6fe86128269fddfb97c70c7236dafa4.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.exe d6fe86128269fddfb97c70c7236dafa4.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml d6fe86128269fddfb97c70c7236dafa4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5e4af433dffee02ea399a148096219c60
SHA10323d9a54821ecd0ec4ef68b5aa3062bed71c9cb
SHA2563827199ca49b329520e5bdf55da2b66e7b882f04595f2619c52e2d5d74fcfd1e
SHA5124537b44317cbc02c4191a8c19acaac06a59ebbe7b9bf43cc9676692fea0e4665df1b91ee3383da8a3f3c544e12a642c49df1aa56cd55f1e3b0eb4733af7355e7