127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
Size

134KB
MD5

3600131e2c712af5b04dea74c972927e
SHA1

4a127dd626ad61075fdde04418c5a8f2baa1491b
SHA256

127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad
SHA512

eff8766a36ba271b6102d536767e0a20d0a57d51d4e1f589f43b44f2fa7ec0667935bbf7b080fcc0d2a1b11a59e276339cd2878962f9c557acc17d564a804b86
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC4:+nymCAIuZAIuYSMjoqtMHfhfqnXwXwS

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b000000012250-2.dat	UPX
behavioral1/files/0x00020000000106dd-6.dat	UPX
behavioral1/memory/2440-640-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012250-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2440-640-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe

C:\Users\Admin\AppData\Local\Temp\127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
"C:\Users\Admin\AppData\Local\Temp\127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe"
1⤵
- Drops file in Program Files directory
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
134KB

MD5
42e30cfb89dd506544cb468647995c92

SHA1
9d35c2727f0b2399802a1be2b80f5bc439ce40aa

SHA256
d5b54e5a7e09175cc121b2b80fa7053d8b19e7d612ea81b6128191472cd844b1

SHA512
be36f246987c391e4a1f876514d3c1889b3a9d0f07ee51d20bc517540a91d62ba1dde32e63859448507c3f64a8e77820b74a77150e84d2fc848a66ad0063bdd9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
143KB

MD5
8f8dd02ff685c895c7b7f67e8c4210ea

SHA1
2c07d57cc70374e095fea038383c1fb21305e5e9

SHA256
86397c2d143ad72ca75570b04616d6e4dc8a1a088cb43919c8fb723e0a779acd

SHA512
0a690b8b7f6913e3ab27c25a70de838c68c631f2a288e643ac4ae8d258119fffa0f909150dca844730394931417184c4b68bd7f2b48b4ee2584da8eae87c9e20

Download Submit
memory/2440-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2440-640-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download