Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 17:58
Behavioral task
behavioral1
Sample
dfc431220ba7c2e5de0dfe93ffb6c11c.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfc431220ba7c2e5de0dfe93ffb6c11c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
dfc431220ba7c2e5de0dfe93ffb6c11c.exe
-
Size
1.8MB
-
MD5
dfc431220ba7c2e5de0dfe93ffb6c11c
-
SHA1
5fdb4e4d3c8779d224e0524cc565b856cf1c4351
-
SHA256
c5e3528bb523b59a142d94e06e00bb2eb830e23c69f6a8de8b97af05cad03eb2
-
SHA512
c5c8163263616aa2eb8f6ae302bfd559f4e778a5a09469523455159b845c3c20f575f75d571cca677beb0f5fb573be193cf4dfc13f251f9e60f18b6852ee90ec
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqz:SCqm2Jpr0nNM7Dus7NxG
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3212-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228b4-5.dat upx behavioral2/memory/3212-1520-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI dfc431220ba7c2e5de0dfe93ffb6c11c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msolui.rll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dom.md dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\7-Zip\Lang\id.txt.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\System\ado\msador15.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SpreadsheetIQ.ExcelServices.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Shared.Windows.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2native.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\meta-index dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\EmptyReport.rdlc.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\System\ado\msader15.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Internet Explorer\ExtExport.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.exe dfc431220ba7c2e5de0dfe93ffb6c11c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb dfc431220ba7c2e5de0dfe93ffb6c11c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD52354bc88ba5e67e54d71fa532229e142
SHA1a309aeff41ccfb5c1aace63f0c9a49cb0697af03
SHA256e1cdb8647939ec491c4aed2d50efbe7a264de87dd4f8affeb8bcaf542efb18e1
SHA5124aaa8e0949123639f671d37f1dfaffd3db0692489915c1f6b146709a88cbf213b928471badceb138e5e425e2d046279878d6849b9d20ebe33fbe175f4135cdb4