3225f3fe120aeb89f32c3b07983537113d7ec0504baa1af8bfeb40c1ab7fc598

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
Size

1.8MB
MD5

934366e68cfcc1a673a29af6c1acc62d
SHA1

5fcd5897d9a0524011aa95ad22d49892dffd2a78
SHA256

3225f3fe120aeb89f32c3b07983537113d7ec0504baa1af8bfeb40c1ab7fc598
SHA512

1c3d85a71a3e89032986da35b8cc6ec7bdfc160af1ac5c8228f118b7be7fd3e3aa3076b750574db665e2c3e9e752f6f4aa9d0ab6949fa689148a16ff8898337a
SSDEEP

24576:N6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqWLCvh:NCqm2Jpr0nNM7DuQ7Nxop

Score

6^/10

upx

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\desktop.ini	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral2/files/0x000200000002299d-5.dat	upx
behavioral2/memory/4992-1560-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral2/memory/4992-13990-0x0000000000400000-0x00000000005BB000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-200.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-200.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-72_altform-unplated.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Sunset.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-200.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\MedTile.scale-125.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-24_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Java\jre-1.8\lib\rt.jar.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-100.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-200.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-unplated.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-100.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-125.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-20_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-100.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-200_contrast-white.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\NoiseAsset_256x256_PNG.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\JitV.dll	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-125.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png.exe	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_934366e68cfcc1a673a29af6c1acc62d_snatch.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
93de61bab8ad4aae0e6c326657cb9d5a

SHA1
1f24e899375cf1302dfd214401c5ba4a86601a69

SHA256
f678c88dc7a91cdbadbb1f80588cdfcc850470fe9fac03e73d7c91e6ea72a3ea

SHA512
db0eb7f513d47a2c448dafb9b1fe1249fa6bf02881442c056ff798be287b42d536b20aa35587eb316b701af19d50b7ea9d97c05273a06bda057710890fd24131

Download Submit
memory/4992-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4992-1560-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4992-13990-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads