448f726453f9c3a4c2006b1a06ce63bc5a8c146be2f12dd6f9330b50c76c6a38

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
Size

152KB
MD5

eff81e36e3c27cbbeca1914ec08a0395
SHA1

0ed025f291b91237f989c0199bc87c66dd721ad5
SHA256

c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc
SHA512

eac68a3e1dbc82b32ecbb461f6abc2026887cc09ab5ad4206f8722800c827e7ed90242f489d4d8c3f6da055237c5c14580e5a7b8c1559adbc13f595973daa525
SSDEEP

768:olnK2Eq3GcOn0oo4d3hhWAWhNefwMJ7BikibDVgPsNE+O:KEq3GcOR3hhKh6w6ikEPTO

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1184-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0001000000010620-5.dat	upx
behavioral1/memory/1184-1459-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\desktop.ini	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ko.txt	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Internet Explorer\jsdbgui.dll	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\de.txt	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nb.txt	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\th.txt	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\System\en-US\wab32res.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\System\msadc\handler.reg	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\IEShims.dll	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\DVD Maker\sonicsptransform.ax	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File opened for modification	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
File created	\??\c:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe

C:\Users\Admin\AppData\Local\Temp\c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe
"C:\Users\Admin\AppData\Local\Temp\c3788feb3a3c0bae28b2195ac8a2455c7c77672b87ae9edd4bfb90f434994ebc.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.7MB

MD5
e5a3f12973587bed2ca626a78bb642e4

SHA1
599b7c465082ebb75ea7ea2e8b448ff6a1c9539e

SHA256
f459c7373294f6d89c078993caccac8ab722ff20a5845e4c1b88fbf596f43a8f

SHA512
ee47c553c871e0d78f172e084dafe2754ad71651b8ee0ebce10113f143d02d20c6d6d95365b0106742301c75731e350fb17066614c442bfa4519b461ffce8b8e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

Filesize
7KB

MD5
6a922ae3979f4cd80d73e62711c19826

SHA1
4cc0a5bf46db54e1c54059394fb9f64b95d4ef69

SHA256
9cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61

SHA512
a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3

Download Submit
memory/1184-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1184-1459-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download