47f0f6bc190c716d06cc2473db97d862d2b8aaff8665bce4bb0bd086eb89bb1c

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dfa0302b2f110520ddbabf9b41818c8c.exe
Size

1.8MB
MD5

dfa0302b2f110520ddbabf9b41818c8c
SHA1

3f22cb1d981754047466a41de702e0b3a499dd23
SHA256

47f0f6bc190c716d06cc2473db97d862d2b8aaff8665bce4bb0bd086eb89bb1c
SHA512

09f7725245521f9ca84bd89bcdc253f1650658f6c72c6c111f3902eb9e99e6efd5345408ecdd6e65bcbbd365ba44809a0497b84631919bf7983389aa91643902
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq3:SCqm2Jpr0nNM7Dus7NxO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1968-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000022893-5.dat	upx
behavioral2/memory/1968-5813-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/1968-13463-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\desktop.ini	dfa0302b2f110520ddbabf9b41818c8c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-125.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-200.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-150.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Xaml.resources.dll	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psm1.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-150.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-125.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.OneNote.dll	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-200.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsBadgeLogo.scale-100.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-200.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as80.xsl	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-30_altform-unplated.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\en-us\office_strings.js	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-400.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-150.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-black.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Connecting.m4a.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsBase.resources.dll.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.Calendar.ot	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.scale-200.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.ILGeneration.dll.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.exe	dfa0302b2f110520ddbabf9b41818c8c.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymxb.ttf	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms	dfa0302b2f110520ddbabf9b41818c8c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms	dfa0302b2f110520ddbabf9b41818c8c.exe

C:\Users\Admin\AppData\Local\Temp\dfa0302b2f110520ddbabf9b41818c8c.exe
"C:\Users\Admin\AppData\Local\Temp\dfa0302b2f110520ddbabf9b41818c8c.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
f2061a54bfe5b989baa53d960670dc01

SHA1
cf17abe761da455dea40f43aa7aedb2c1d3ac7a6

SHA256
ed6d07791efa1ee79ba7283b2c210feac5144fb9927d136a9cfc92754b86ac04

SHA512
674e1dcebbe955261f9580dd055ba3771cf6d130b2a60ab2717928d5c65dc8b230b979ade2b321185370055efe916858eb499fa5c9099395de2f46af616dacb7

Download Submit
memory/1968-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1968-5813-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1968-13463-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads