21f03735ea89780861e0752485060c6fad31887df9f32884f6189e36276d09d7

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
Size

202KB
MD5

ff4ca3f3bddf8acc7180f214bb133174
SHA1

efc2c19327456d62031c4c55aa6af26031ef7efe
SHA256

874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8
SHA512

216119340ad73b4ce7a44ef117f25eb8dd65306f0a886215fdcd82a53608a3f3836f63bf34a58681690ca48a61ed3b73e3f8ee50d21acbf8fc8ba9be99547096
SSDEEP

6144:TeEk+CEFMFnsVo8PPfwOKRlixTmAcThAkZThMTM1:ioCEFMFnZ8PPfwOKDix1c60yE

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/904-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0016000000010627-5.dat	upx
behavioral1/memory/904-1400-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Pipeline.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\br.txt	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\kaa.txt	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\NOTICE	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ast.txt	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DissolveAnother.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File created	\??\c:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe

C:\Users\Admin\AppData\Local\Temp\874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe
"C:\Users\Admin\AppData\Local\Temp\874c2e6f552ddd05c4a2f51a7859422bdb36992ab31f92480f15a355eaf799f8.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.7MB

MD5
5457d7560bae1cdda685d1cd4bbb9d1c

SHA1
15f07afc5464079ab3a77349698ab8dd2aa822eb

SHA256
b47b47528ab3e19402c14f4a5e0e9a6f6e93abef905396ef3c77d102a3efce88

SHA512
1b933c77484596c2ccafb73ef35bc06a5ff9b0aca0608874dd937bbfe0a184cd4d79b059e04f098a577c9f07def8420e26d20dfd288c8e9e8152bfe87be01715

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

Filesize
7KB

MD5
6a922ae3979f4cd80d73e62711c19826

SHA1
4cc0a5bf46db54e1c54059394fb9f64b95d4ef69

SHA256
9cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61

SHA512
a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3

Download Submit
memory/904-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/904-1400-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download