920babb5e037668f7e203f0e57724bc7701e277800bca96f76e16a8096be71a6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d7bd7ea2caeaae25f61576e7c4d633cc.exe
Size

303KB
MD5

d7bd7ea2caeaae25f61576e7c4d633cc
SHA1

b09fe8172c4237bad11c9d1ec0b472074d0482b7
SHA256

920babb5e037668f7e203f0e57724bc7701e277800bca96f76e16a8096be71a6
SHA512

6554b109fa2de1fb44aba25f05b60a6bcef694d6db86d24d0c1c78990eee13cf0bf5fa74c7f49940196d9968a06d856dee7b61adfac4ece16cef2834e76211e6
SSDEEP

3072:a2i99xNKkYsN41io7jq0EM/I1gQ/NpPyuwJuxtxujXaKF5g6dkdR8T:P+fXSiE/hgyuwJuxtxujXabC

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	d7bd7ea2caeaae25f61576e7c4d633cc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\7-Zip\Lang\cs.txt	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\include\jawt.h	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadcer.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\eula.rtf	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Internet Explorer\DiagnosticsHub_is.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DissolveNoise.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\es.txt	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties	d7bd7ea2caeaae25f61576e7c4d633cc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui	d7bd7ea2caeaae25f61576e7c4d633cc.exe

C:\Users\Admin\AppData\Local\Temp\d7bd7ea2caeaae25f61576e7c4d633cc.exe
"C:\Users\Admin\AppData\Local\Temp\d7bd7ea2caeaae25f61576e7c4d633cc.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.8MB

MD5
d8765844dd3670c4d927107c0c5fdd58

SHA1
d53dfb45c1a7162a12e3291b31b901c88d8de01b

SHA256
a39f592227bf6dd3fd6a32817248e5725ab1f2261f2c7145541130a725310237

SHA512
e2644e20c76787156f33df7de73a5925bcc5309e8b6f85ec24b0dbda43d8fedf5de9666bc7228fb129fb7ffb442f262c8fae6a57e540d97b3ff856a5dabf1f4d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
memory/1960-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1960-201-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1960-254-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1960-599-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1960-1128-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads