328eb07da61d583ab3ec8a107c7b57ab7555a9a41ed0b2d4955c3b8192aad115

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
Size

1.8MB
MD5

2f8359d2d10317a881aa3a1e239ab03a
SHA1

b0d6fc6264a6efc6ff088ef1d6d1d0849675bbc8
SHA256

328eb07da61d583ab3ec8a107c7b57ab7555a9a41ed0b2d4955c3b8192aad115
SHA512

2813f3cc6fb2078b787b9195c3ab196d45662167d5c4f65a0623ce60f5feb49a303d7c7e6e3fe55ae83f4348397a0123ed0f0e39b967020cf3bd2d7c05078d1e
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH5:SCqm2Jpr0nNM7Dus7Nx2Z

Score

6^/10

upx

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\desktop.ini	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3020-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0002000000022983-5.dat	upx
behavioral2/memory/3020-1002-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/3020-14174-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-100_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-24.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-synch-l1-2-0.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-125.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppSettingsCppCX.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\VBAJET32.DLL.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\illustration-UploadToOD.svg	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100_contrast-black.png.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-200.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\MediumTile.scale-200_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_360x120_2x.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNativeWebViewBridge.winmd.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\resources.pri.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-20.png.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-150.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraChart.v8.1.Design.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\0.rsrc.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-400_contrast-black.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-colorize.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-30_altform-unplated.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-150.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.INF	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-white.png.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-100.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-32.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSORES.DLL	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.exe	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.GIF	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-400.png	2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-15_2f8359d2d10317a881aa3a1e239ab03a_snatch.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
d9823f19c4d617fd7be14c174ae0003f

SHA1
a140925899fcc6df9daa89037ef78fd46b71a04f

SHA256
7f77e24b36332cda6016c746ccbbce3265e771ca3dc2bb8e758e0342eacdc602

SHA512
6a2deeda9879b2827122297879cd8356e095afc3b2f2a5559792ce2aa364d09c9c79e9ca5f391bc788395b65977b72c776ac55d77a0e6cb4d5184d01abccd4e5

Download Submit
memory/3020-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3020-1002-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3020-14174-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads