0ba933cacc75c04d948e09f8d545293702550e45afd22e12831ff99880f0e01f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e01902ff77df906600eb872bcd857ea8.exe
Size

2.8MB
MD5

e01902ff77df906600eb872bcd857ea8
SHA1

24aa46ae9741b11ac3d1ed4c4c617b9ce55695e5
SHA256

0ba933cacc75c04d948e09f8d545293702550e45afd22e12831ff99880f0e01f
SHA512

15b1bf94beddb423244dfab30cb299a945deb3e9dc29c277cac71a0070128a3fb81a93ee0a575a509d2d70b7a19b66a817f68500f54e6b33bc92a87420c8989d
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91M:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0030000000013adc-5.dat	upx
behavioral1/memory/2364-1843-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/2364-8283-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	e01902ff77df906600eb872bcd857ea8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\BlockLimit.tmp.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.exe	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif	e01902ff77df906600eb872bcd857ea8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Samara	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.exe	e01902ff77df906600eb872bcd857ea8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.exe	e01902ff77df906600eb872bcd857ea8.exe

C:\Users\Admin\AppData\Local\Temp\e01902ff77df906600eb872bcd857ea8.exe
"C:\Users\Admin\AppData\Local\Temp\e01902ff77df906600eb872bcd857ea8.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
2.8MB

MD5
9f21aab16865ed5a4ea58a451ccec612

SHA1
61d2b5eae0fb4314675ef30f8577468a7c28baa2

SHA256
4d92e236f1d33b80c3d7f01fe4fa9cf2f4231eb32774aa03f9af99a7269f8a68

SHA512
10d7521bfa1b301ff37dbe2b5825dc8637e5165fe07108ab4df9a391a415868b68d632e754fb691d4c9af15f528cfa360fb301f9ecb883e318cb267472f72ff9

Download Submit
memory/2364-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2364-1843-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2364-8283-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads